Re: Policy enforcement point

Jonas wrote on 02/04/2008 02:31:27 PM:

...snip...
> > Therefore, if you have non-public data or you support POST, then you
> > usually need to have server-side logic anyway, in which case there
isn't
> > much use for client-side PEP. If you have public data, then you also
> > don't need client-side PEP since it's OK for everyone to access the
data.
>
> But we're still giving servers the ability protect themselves against
> sharing their security policy if they so wish, by using server side PEP.
>
> Sounds to me like your argument is simply that client side PEP adds
> complexity without adding much value. Is that correct?

Yes

...snip...
> > Over at OpenAjax Alliance we have had lots of discussion about the
> > security implications of Access Control. My personal opinion, informed
> > by this discussion, is that there is some vulnerability in selected
> > scenarios to man-in-the-middle attacks and password stealing attacks,
> > but these scenarios appear to be on the fringe and unlikely to happen
> > often in practice, and if they do happen often enough, the community
can
> > be educated about how to deal with them. In general, the WAF WG should
> > be commended for their strong efforts to take into account security
issues.
>
> Sorry, this is very much lacking the detail I was asking for so I can't
> really evaluate it one way or another.

I'm not asking you to evaluate. I was trying to say that I think Access
Control is safe enough.