Re: [integrity]: Origin confusion attacks. from Devdatta Akhawe on 2014-01-09 (public-webappsec@w3.org from January 2014)

From: Devdatta Akhawe <dev.akhawe@gmail.com>
Date: Thu, 9 Jan 2014 15:25:33 -0800
To: Mike West <mkwst@google.com>
Cc: "public-webappsec@w3.org" <public-webappsec@w3.org>, btoews@github.com, Joel Weinberger <jww@google.com>, Frederik Braun <fbraun@mozilla.com>
Message-ID: <CAPfop_14gVNO8VPbp=MR6DO+xpFeve64oz4X=fc7ghAfYdXAsA@mail.gmail.com>

> I don't have a good mitigation idea off the top of my head, but I agree it's
> something we should worry about.

I view the integrity-based cache more of a "good-to-have" feature
rather than important to the main use case of the spec. Maybe just
removing this should also be on the table as a possibility? (in case
we can't come up with a clean solution)

--dev

Received on Thursday, 9 January 2014 23:26:19 UTC