W3C home > Mailing lists > Public > public-webappsec@w3.org > July 2014

Re: SRI and CORS

From: Adam Langley <agl@google.com>
Date: Thu, 3 Jul 2014 06:21:22 -0700
Message-ID: <CAL9PXLw42VGPBEiWWrpVyVdyQVbSfiZv1wtUsN1oA4oOfVvgtw@mail.gmail.com>
To: Anne van Kesteren <annevk@annevk.nl>
Cc: WebAppSec WG <public-webappsec@w3.org>
On Thu, Jul 3, 2014 at 2:02 AM, Anne van Kesteren <annevk@annevk.nl> wrote:
> It seems that if you can already proof what the bits of a resource
> are, maybe you should be able to get hold of it with all the benefits
> of CORS. Probably given a secure enough hash algorithm. Have people
> been thinking about this?

What if I know that the resource is one of $n values and so try $n
different loads, with different hash values, in order to find which it
is?


Cheers

AGL
Received on Thursday, 3 July 2014 13:22:08 UTC

This archive was generated by hypermail 2.3.1 : Monday, 23 October 2017 14:54:06 UTC