W3C home > Mailing lists > Public > whatwg@whatwg.org > January 2006

[whatwg] validate attribute in <A>

From: James Graham <jg307@cam.ac.uk>
Date: Wed, 25 Jan 2006 23:14:36 +0000
Message-ID: <43D8065C.7090200@cam.ac.uk>
Mike Hoye wrote:
> [a href="http://foo.com/mozilla-i686.tgz"
>  validate="{md5}b63fcdf4863e59c93d2a29df853b6046"]
> and the client could verify as it comes in that it does at least have
> the md5sum that's advertised.  User notifications could include "no
> validation", "successfully validated" and "failed validation", and act
> according to the user's wishes in each case.

It seems to make phishing scams easier (or at least easier to make
convincing). If evilsite.com has a hacked version of Firefox accessible
via an <a validate="hash_from_hacked_firefox"> then anyone downloading
Firefox from evilsite.com will be told that the download "successfully
validated" which (misleadingly) suggests it is the real Firefox.

That doesn't leave the attribute totally useless as it would catch the
case where a trustworthy website used a mirror network which was
compromised. On balance though I don't see the security effect of this
as a net positive (but I'm not a security guy so I'm happy to be corrected).

"It seems to be a constant throughout history: In every period, people
believed things that were just ridiculous, and believed them so strongly
that you would have gotten in terrible trouble for saying otherwise."

-- http://www.paulgraham.com/say.html
Received on Wednesday, 25 January 2006 15:14:36 UTC

This archive was generated by hypermail 2.3.1 : Monday, 13 April 2015 23:08:25 UTC