Hi,
_______________________________________________ cap-talk mailing list cap-talk@... http://www.eros-os.org/mailman/listinfo/cap-talk
Tom Van Cutsem wrote: >I've written up an introductory article on E-style membranes in Javascript. >This may be useful if you need to convince someone that it's possible to >create revocable ocaps on entire object graphs: > >http://soft.vub.ac.be/~tvcutsem/invokedynamic/js-membranes Thank you! You might also enjoy this research paper: Object Views: Fine-Grained Sharing in Browsers. Leo A. Meyerovich, Adrienne Porter Felt, and Mark S. Miller. WWW 2010. http://www.cs.berkeley.edu/~afelt/views-www-2010.pdf It discusses how to use membranes to implement sophisticated, fine-grained access control to Javascript objects.
Bookmarks are a very convenient place to store secrets, especially secrets that are not human readable, but not a very safe place to store secrets. Unfortunately browser are apt to send copies of urls off to all and sundry. What parts of a url are supposed to be safe to have secrets in? If an addon or a plugin were to phone home with full urls, rather than expurgated or truncated urls, would the addon be plausibly accused of being spyware, and, if so accused, corrected to truncate the url to avoid being placed on a spyware list? Are there some parts of urls that are not supposed to be passed around to all and sundry, that are supposed to be safe to have secrets in?
Nothing in the URL is safe. You could hide capabilities in cookies, but that often defeats the purpose.
Bookmarks are a very convenient place to store secrets, especially
secrets that are not human readable, but not a very safe place to store
secrets.
Unfortunately browser are apt to send copies of urls off to all and sundry.
What parts of a url are supposed to be safe to have secrets in?
If an addon or a plugin were to phone home with full urls, rather than
expurgated or truncated urls, would the addon be plausibly accused of
being spyware, and, if so accused, corrected to truncate the url to
avoid being placed on a spyware list? Are there some parts of urls that
are not supposed to be passed around to all and sundry, that are
supposed to be safe to have secrets in?
_______________________________________________
cap-talk mailing list
cap-talk-r2jiIPW7MOYEUp5O9OQuKg@public.gmane.org
http://www.eros-os.org/mailman/listinfo/cap-talk
_______________________________________________ cap-talk mailing list cap-talk@... http://www.eros-os.org/mailman/listinfo/cap-talk
What parts of a url are supposed to be safe to have secrets in?
If an addon or a plugin were to phone home with full urls, rather than
expurgated or truncated urls, would the addon be plausibly accused of
being spyware, and, if so accused, corrected to truncate the url to
avoid being placed on a spyware list? Are there some parts of urls that
are not supposed to be passed around to all and sundry, that are
supposed to be safe to have secrets in?
_______________________________________________ cap-talk mailing list cap-talk@... http://www.eros-os.org/mailman/listinfo/cap-talk
RSS Feed
