On 10/13/09 6:02 AM, David Booth wrote:
Getting a scheme registered is the *easy* part. The hard part is getting millions of installed clients to implement the special recognition of that scheme.
I agree, and I think what you're proposing is interesting along those lines. I also appreciate your answers to my earlier questions. Right now we have no guidance or analysis that goes into the associated risks of what you are proposing. A few examples of things that can and will go wrong with non-participants:
1. A query goes out to a third party, and the site is down or unreachable. In this case, the non-participant will hang in an unspecified way rather than get a hard error. 2. A query goes out and the third party has been compromised. And in this case, the third party is a really attractive target because one can map administrative resources with SSH. Worse, the client acts on the meta-information in some way, leading to additional compromises. You're already using redirects. So what can a bad guy redirect to in order to make things interesting? Well, he's got a Browser: header. Perhaps he redirects to an appropriate exploit.
Now to be fair to you, I haven't done the analysis to say, "this is ABSOLUTELY a problem", but nor have I seen an analysis from you that leads me to conclude that this is not a problem.
Eliot