Re: draft-montenegro-httpbis-uri-encoding

On 2014-03-21 14:58, Nicolas Mailhot wrote:
> ...
>> What I don't understand is how an out-of-band signal that can be
>> incorrect helps. If this is about security-related checks, you can't
>> trust it anyway, no?
>
> In a security context if something is suspicious you block/fail/error out
> and don't ask questions.
>
> With undefined encoding everything is suspicious so you can't act because
> it may be normal.

Again: what makes the out-of-band signal trustworthy?

If it is used for security-related checks, and it gets trusted, then 
attackers *will* forge it.

Best regards, Julian

Received on Friday, 21 March 2014 14:31:57 UTC