Re: [Json] Security Considerations

[Stefan Drees <[e-mail]>]

On 08.06.13 09:00, Peter Brooks wrote: ...
> On 8 Jun 2013, at 05:40, John Cowan ... wrote:
>> Peter Brooks scripsit:
>>
>>> If JSON messages are exchanged in cleartext, that, itself, is
>>> an indication that they are public and unimportant, so the risk, even
>>> if they are intercepted and modified, is low.
>>
>> Open text is not necessarily unimportant text.  Consider these email
>> messages, which are sent en clair.
>>
> I agree. This, though, is bad practice. Any responsible organisation
> ought to encrypt its sensitive information.

No, please do not label "any" cleartext exchange of broadly classified 
"sensitive information" as a generally "bad practice". For "secrets" ok, 
but "sensitive"? No, not in general.

Every communication has its setup phase, many communication channels 
over time change in the degree of what the impact of the transported 
data on the participants or others might be, even time may change the 
amount of "sensitivity" (like the words and deeds of a young person 
might interfere later with the same person later and in unintended ways).

Shaping the future JSON Format for Data Interchange is also possibly 
much more "sensitive" (as it impacts all conforming future JSON 
messages), than attacking the integrity, confidentiality, or flow of 
some JSON text instances based on that spec ;-)

All the best,
Stefan.