The problem with IDP initiated SSO

[Cantor, Scott]

> I have been trying to figure out a scenario where the XSRF attack could be
> used to do real hard. Just now I got an idea.
> 
> Say you have a payment service like amazon or PayPal. You could then use
> this attack to get a victim to enter his/her credit card info on another users
> account.
> 
> What do you think, good example?

The canonical one is depositing money into your account, but that's similar, yes.

-- Scott