The problem with IDP initiated SSO

[Stefan Rasmusson]

I have been trying to figure out a scenario where the XSRF attack could be
used to do real hard. Just now I got an idea.

Say you have a payment service like amazon or PayPal. You could then use
this attack to get a victim to enter his/her credit card info on another
users account.

What do you think, good example?
On 26 Dec 2014 19:43, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

> On 12/26/14, 11:10 AM, "Stefan Rasmusson" <rasmusson.stefan at gmail.com>
> wrote:
>
> >Ok, so you can force a user to be signed in to a back account that you
> >have valid credentials for. Any idea what this attack can be used for?
>
> If you're depositing money?
>
> > Or is it just a general problem that you are able to make the user do
> >that?
>
> XSRF attacks are a general class of attack. I have no special expertise in
> understanding them.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150113/fa9c09a2/attachment.html