- From: Aymeric Vitte <vitteaymeric@gmail.com>
- Date: Sat, 23 Mar 2013 00:12:32 +0100
- To: Ryan Sleevi <sleevi@google.com>
- CC: "public-webcrypto-comments@w3.org" <public-webcrypto-comments@w3.org>
- Message-ID: <514CE560.5050105@gmail.com>
I thought that by "physical access" you meant that Jane can access John's computer. But probably you mean that she intercepts John's connection. She does not need to do so, she could get John's messages from his computer (wireshark or other if no SSL/TLS for the site). Again, unlikely but possible, because if the site relies on its own secure system, it might not use SSL/TLS. Regards, Le 22/03/2013 23:45, Ryan Sleevi a écrit : > I'm not sure what you mean - Jane's "use of web console" is a physical > access attack. > > > On Fri, Mar 22, 2013 at 3:42 PM, Aymeric Vitte <vitteaymeric@gmail.com > <mailto:vitteaymeric@gmail.com>> wrote: > > That's a different version of Jane's attack (from web console, > then physical access) against John described in WebCrypto Use Cases. > > More difficult and more unlikely, but maybe not if we go outside > of John/Jane's simple context. > > Then maybe it should be referenced somewhere. > > Regards, > > Le 22/03/2013 19:48, Ryan Sleevi a écrit : >> Physical access attacks MUST remain out of scope of this work. >> >> >> On Fri, Mar 22, 2013 at 11:12 AM, Aymeric Vitte >> <vitteaymeric@gmail.com <mailto:vitteaymeric@gmail.com>> wrote: >> >> Tricky, difficult or completely unlikely but maybe possible : >> Use Case, John and Jane, Jane does not leave John but wants >> to spy him, sometimes she uses his computer then knows how to >> access it, while John is visiting the social site he leaves >> 5mn to see the postman, she inserts from his web console an >> iframe in the page (jane.com <http://jane.com>) and sends a >> postMessage with John's keys to the iframe which "stores" (ie >> references the underlying data) the keys in jane.com >> <http://jane.com>'s indexedDB. She intercepts John's >> connexion and decrypt messages with John's computer when he >> is out reinjecting messages using jane.com <http://jane.com>. >> >> Usually this will not work because outside origin iframes can >> not access indexedDB, but indexedDB spec just says : User >> agents MAY restrict access... >> >> Regards, >> >> -- >> jCore >> Email : avitte@jcore.fr <mailto:avitte@jcore.fr> >> iAnonym : http://www.ianonym.com >> node-Tor : https://www.github.com/Ayms/node-Tor >> GitHub : https://www.github.com/Ayms >> Web : www.jcore.fr <http://www.jcore.fr> >> Webble : www.webble.it <http://www.webble.it> >> Extract Widget Mobile : www.extractwidget.com >> <http://www.extractwidget.com> >> BlimpMe! : www.blimpme.com <http://www.blimpme.com> >> >> >> > > -- > jCore > Email :avitte@jcore.fr <mailto:avitte@jcore.fr> > iAnonym :http://www.ianonym.com > node-Tor :https://www.github.com/Ayms/node-Tor > GitHub :https://www.github.com/Ayms > Web :www.jcore.fr <http://www.jcore.fr> > Webble :www.webble.it <http://www.webble.it> > Extract Widget Mobile :www.extractwidget.com <http://www.extractwidget.com> > BlimpMe! :www.blimpme.com <http://www.blimpme.com> > > -- jCore Email : avitte@jcore.fr iAnonym : http://www.ianonym.com node-Tor : https://www.github.com/Ayms/node-Tor GitHub : https://www.github.com/Ayms Web : www.jcore.fr Webble : www.webble.it Extract Widget Mobile : www.extractwidget.com BlimpMe! : www.blimpme.com
Received on Friday, 22 March 2013 23:09:54 UTC