Metadata "trust"

[Leif Johansson]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 03/19/2012 04:39 PM, Christopher Bongaarts wrote:
> On 3/14/2012 8:40 PM, Cantor, Scott wrote:
> 
>> That said, sure, if you trust the SSL/TLS connection, then
>> you're essentially getting the metadata direct from the source,
>> and as long as you're willing to trust the peer to tell you
>> anything you want to know about the peer, that's fine.
> 
> Not to mention that there's nothing precluding the metadata at,
> say, www.providerA.com from "accidentally" including bogus data for
> an entityID for competitorB.com (this is one of the reasons why 
> automatically loading metadata, even signed metadata, is risky).
> 

But that would break the signature, right?
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk9nVBYACgkQ8Jx8FtbMZnc0HQCfah3UWWO10ERR6vVY0GViUyWS
XqEAoI/r+5kXQHo1aeyXfzblZJc7IEgI
=LAGj
-----END PGP SIGNATURE-----