Re: Insecure WWW Access Authorization Protocol? michael shiplett <email@example.com>
Date: Tue, 8 Mar 1994 23:21:01 --100
From: michael shiplett <firstname.lastname@example.org>
To: Multiple recipients of list <email@example.com>
Subject: Re: Insecure WWW Access Authorization Protocol?
X-Listprocessor-Version: 6.0c -- ListProcessor by Anastasios Kotsikonas
"ts" == Tony Sanders <sanders@BSDI.COM> writes:
ts> michael shiplett writes:
>> "ts" == Tony Sanders <sanders@BSDI.COM> writes:
>> The URL is as trustworth as the source of the URL--whether the
>> source is in or out of band.
ts> If you cannot trust the server reply to get the realm information from
ts> then why do you think you can trust the URL? You have exactly the
ts> same problems as when you started.
Currently there is no mapping between the URL and the server's
identity--this is correct. I am proposing that the client authenticate
to an identity based on the URL. In this proposal I am not trusting
the server to give *any* information regarding its identity. As long
as the URL for a given service is trusted, authentication to said
service can proceed in a secure manner. Everything proceeds from a URL
not from the initial connection to the service.