Metadata "trust"

[Leif Johansson]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 03/19/2012 04:47 PM, Cantor, Scott wrote:
>>> Not to mention that there's nothing precluding the metadata
>>> at, say, www.providerA.com from "accidentally" including bogus
>>> data for an entityID for competitorB.com (this is one of the
>>> reasons why automatically loading metadata, even signed
>>> metadata, is risky).
>> 
>> But that would break the signature, right?
> 
> The genesis of this was if you didn't sign it at all and just
> blindly trust SSL connections. If the threat is somebody else
> slipping something into the file, and it was signed, then yes, it
> would break. If the threat is just a legitimate signer speaking
> about somebody else's metadata, then it wouldn't. That's why I
> built the Dynamic plugin, I don't think it's the right thing to use
> the third party plugin to fetch metadata directly from a peer.


gotcha and agreed.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk9naFwACgkQ8Jx8FtbMZnc7owCgk7WEM3jxruMwW7PoBnZSCNcp
HgcAn0KUoctEhFdJbachsqbEpJuznrjp
=EX3T
-----END PGP SIGNATURE-----