Re: Use case - John and Jane

The threat model described in the use cases document is definitely a "physical attack" and the mitigation provided isn't sufficient. Once the user Jane has access to the computer, many things can be done. I think that use case should be removed or re-phrased, especially since it is misleading, however it *was* described as is verbatim at the F2F by a social network :) 

The use case for script-hashing *within the context of the main page over HTTPS* still stands, but shouldn't be shoe-horned as a mitigation for a physical attack. I intend to change this in the use cases document. 

----- Original Message -----

> Ryan,

> I don't understand the deviation of the initial subject to
> sop/http-https origin, this has nothing to do, your faith about sop
> is just theoretical, in reality browsers implement many workarounds
> to live with this model.

> Now coming back to the initial subject, it just shows that under some
> circumstances, you can get access to the keys of someone else, and
> it's a physical attack as well as WebCrypto solves a physical attack
> described in the Use Cases, then if WebCrypto does not deal with
> physical attacks, don't put an explicit example in the
> documentation.

> Regards,

> Le 23/03/2013 01:39, Eric Rescorla a écrit :

> > On Fri, Mar 22, 2013 at 5:38 PM, Ryan Sleevi < sleevi@google.com >
> > wrote:
> 

> > > On Fri, Mar 22, 2013 at 5:33 PM, Eric Rescorla < ekr@rtfm.com >
> > > wrote:
> > 
> 

> > > > On Fri, Mar 22, 2013 at 4:57 PM, Ryan Sleevi <
> > > > sleevi@google.com
> > > > >
> > > > wrote:
> > > 
> > 
> 
> > > > > Scheme is either HTTP or HTTPS. An origin accessed over HTTP
> > > > > is
> > > > > *not*
> > > > > the same as an origin accessed via HTTPS - because they are
> > > > > different schemes.
> > > > 
> > > 
> > 
> 
> > > > Ryan,
> > > 
> > 
> 

> > > > I generally agree with your argument here, but I wanted to
> > > > observe
> > > 
> > 
> 
> > > > out that there has been some discussion of mechanisms for
> > > 
> > 
> 
> > > > authenticating JS delivered over HTTP (e.g., script-hash).
> > > 
> > 
> 

> > > > I don't think this changes your basic point though.
> > > 
> > 
> 

> > > > -Ekr
> > > 
> > 
> 

> > > Sure, but that's been in the context of the main page (and
> > > therefore
> > > origin) are delivered over HTTPS, and it securely indicates the
> > > script-hash for resources to load over HTTP (eg: to permit edge
> > > caching).
> > 
> 

> > > An HTTP page embedding HTTP resources with script-hash is as
> > > insecure
> > > as an HTTP page embedding HTTPS resources, which is as insecure
> > > as
> > > an HTTP page embedding HTTP resources - the attacker can always
> > > modify the HTTP page itself.
> > 
> 

> > I have no argument with this message.
> 

> > -Ekr
> 

> --
> jCore
> Email : avitte@jcore.fr iAnonym : http://www.ianonym.com node-Tor :
> https://www.github.com/Ayms/node-Tor GitHub :
> https://www.github.com/Ayms Web : www.jcore.fr Webble :
> www.webble.it Extract Widget Mobile : www.extractwidget.com BlimpMe!
> : www.blimpme.com