ECP Newbie question

[Chad La Joie]

On Wed, Apr 4, 2012 at 10:39, Cantor, Scott <cantor.2 at osu.edu> wrote:
> That's true in the abstract, but today's world is one in which all clients are pretty much viewed as potential malware and users have no tools to tell. The mobile app stores don't even provide for code signing, AFAIK, which is a seriously underused tool if you start with an empty root store.
>
> The other problem is how to implement "knows about your specific IdP". This isn't a solved problem, and the known solutions all have issues. Not unique to SAML issues, but they still aren't solved except at an enterprise provisioning level (802.1x has the same problems, as does OAuth, as does SSH, as do web browsers).

Right, in both cases though it's not phishing in the traditional
sense.  The first case requires an attacker to get you to install
malware before you'd be contacting any site.  The second requires an
attacker to get you to configure the client improperly.  So, both are
cases are still bad and still compromise things, but they aren't what
I'd call a phishing attack.

-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered