Shibboleth Security Advisory [24 October 2011]

[James F. Green]

Guys, thanks a lot, that clarifies it for me.  I've been talking to our network security guys and as usual they are telling me hair-raising stories.  We are thinking carefully about what we are releasing to SPs.


On Oct 25, 2011, at 1:44 PM, Cantor, Scott wrote:

> On 10/25/11 1:26 PM, "James F. Green" <jfgreen1 at gmail.com> wrote:
>> 
>> Is it only attributes that are exposed?  Or does the SSO assertion
>> contain other items, for example, session or SSO tokens, that might also
>> be revealed?
> 
> There's nothing relevant but data about the user, or data that can be used
> in various ways and circumstances to get more data about the user from
> sources willing to hand it out. Exposing an assertion doesn't make it any
> more possible to misuse it. If you have the message at all, you can
> potentially misuse it, that's what bearer security means.
> 
>> Also, I am confused by the idea of whether "the browser is not trusted."
> 
> Trusted by you not to expose the message to third parties because it's
> infected with malware. If you want to own the problem of client security,
> you assume anything you give to a client is effectively available to an
> attacker.
> 
> Chad explained the ramifications, I just wanted to explain what I meant by
> trusted.
> 
> -- Scott
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net