Shibboleth Security Advisory [24 October 2011]

[Cantor, Scott]

On 10/25/11 1:26 PM, "James F. Green" <jfgreen1 at gmail.com> wrote:
>
>Is it only attributes that are exposed?  Or does the SSO assertion
>contain other items, for example, session or SSO tokens, that might also
>be revealed?

There's nothing relevant but data about the user, or data that can be used
in various ways and circumstances to get more data about the user from
sources willing to hand it out. Exposing an assertion doesn't make it any
more possible to misuse it. If you have the message at all, you can
potentially misuse it, that's what bearer security means.

>Also, I am confused by the idea of whether "the browser is not trusted."

Trusted by you not to expose the message to third parties because it's
infected with malware. If you want to own the problem of client security,
you assume anything you give to a client is effectively available to an
attacker.

Chad explained the ramifications, I just wanted to explain what I meant by
trusted.

-- Scott