Docusign SSO

[Peter Schober]

* John Dennis <jdennis at redhat.com> [2016-11-29 16:45]:
> Do you believe metadata exchange over TLS as insecure?

I believe you can make this sufficiently secure for most purposes for
a given deployment, if you try.

I'm not convinved the many TLS failures/degradations graphical web
browsers construct new UI elements for all the time are always
automatically handled in the most secure or appropriate fashion by the
underlying libraries, though.

I.e., unless you know for sure how a given software stack reacts to
anything fishy in your connection you have no idea how much (if any)
security TLS gives you: The library might decide to continue. It might
abort. It might log something but still continue.  An OS update migh
swap out your openssl libs for nss (or the other way around). Is that
model still secure then? Is the security stronger or weaker?

This has nothing to do with use of TLS in a graphical web browser,
operated by a (potentially) informed human being. (And I don't claim
to be more than slightly informed as far as TLS goes.) This is how you
can know how a library behaves when used in a software stack you don't
control nor understand.

There's also the fact that metadata exchange relying solely on TLS is
different from accessing a web site with a browser: It's accepting the
content of the communication as a trusted certificate authority, in a way:
You blindy trust any data (plain text file) coming from the network
(which may be the one EntityDescriptor you're expecting, it maybe one
you're not expecting, it may be a bunch of EntitiesDescriptors
injecting all kinds of entities and keys into your system) solely
based on the fact that the system you're connecting to has satisfied
the registration criteria for... what? StartSSL.com? Letsencrypt?
How high is the barrier of entry for those? Oh, and /do/ people modify
the trust store to ensure the library somewhere down in the software
stack only trusts certificates issued by a given CA /you/ decide to
trust (not one that payed the OS vendor to be included)?
etc.pp.

-peter