ECP Newbie question

[Cantor, Scott]

> I can't see how an ECP client would be susceptible to phishing.  The
> whole point of ECP is that it's a "smart", secure client, resident on
> the user's hardware and knows about your specific IdP.  So, there
> shouldn't be anything that a rogue site could do in order to get the
> client to send unintended data back to it.

That's true in the abstract, but today's world is one in which all clients are pretty much viewed as potential malware and users have no tools to tell. The mobile app stores don't even provide for code signing, AFAIK, which is a seriously underused tool if you start with an empty root store.

The other problem is how to implement "knows about your specific IdP". This isn't a solved problem, and the known solutions all have issues. Not unique to SAML issues, but they still aren't solved except at an enterprise provisioning level (802.1x has the same problems, as does OAuth, as does SSH, as do web browsers).

I can say that OSU's use of ECP as a mobile client solution was partly experiment and partly "hey, don't screen scrape me, bro'" I don't know what we're going to do down the road, but I'd guess it will involve a token oriented approach bootstrapped with something ECP-like so that we can limit use of ECP to a single client app we can at least try and educate users on. Or we'll accept that phishing is going to happen and not care because it will be too expensive to care.
 
-- Scott