Re: [ogpx] Seed capability behavior

On Wed, Jan 20, 2010 at 4:50 PM, Hogmanay Milestone <
hogmanay.milestone@yahoo.com> wrote:

> ----- Original Message ----
> From: Infinity Linden (Meadhbh Hamrick) <infinity@lindenlab.com>
> To: David W Levine <dwl@us.ibm.com>
> Cc: ogpx-bounces@ietf.org; "ogpx@ietf.org" <ogpx@ietf.org>
> Sent: Wed, January 20, 2010 4:43:58 PM
> Subject: Re: [ogpx] Seed capability behavior
>
> >1.1. if the seed cap persists for a fixed period of time, the client
> >may request additional services from the seed cap later. it's possible
> >we may want to wait to issue service caps until the client actually
> >tries to do certain things (like spend money, transfer items,
> >inventory access, etc.)
>
> but how likely is this to happen?
>
> >1.2. if the seed cap persists for a fixed period of time, it allows
> >service caps to have shorter lifetimes. deployers may want some caps
> >(like caps for spending money and transferring items) to have a
> >shorter lifetime than others (like caps for connecting to public
> >regions or caps for getting the grid status.)
> >
> >by persisting the seed cap, the client may request a new service cap
> >from the seed without having to re-authenticate.
>
>
> you could request a "new seed" capability from the seed cap, then when you
> need a new one, you access the new seed capability to give you a new seed
> capability.
>
>
how is this different from just keeping the seed cap around? if the concern
is that an attacker will be able to exploit a security vulnerability to
access a seed cap, then it could just as easily extract the "new seed" cap
instead of the seed cap. the attacker could then use the new seed cap  to
get another seed cap, and the client is still pwnd.


>
>
>
>
> _______________________________________________
> ogpx mailing list
> ogpx@ietf.org
> https://www.ietf.org/mailman/listinfo/ogpx
>