security section

I think we also should have a security section in the basic WebID spec.
Here are the two main issues I can think of.

 1. In order to avoid man in the middle attacks https SHOULD be enabled 
on the data for the main WebID PRofile and subsidiary related profile 
documents. Such man in the middle attacks could change information in someone's
profile, before it reaches the user such as a phone number, address or other
means of communicating with the person, such that people relying on it could
end up being mislead.

 2. this ties in with Privacy, so that related ACLed documents should (MUST?) 
be also protected with cryptographic TLS endpoints ( i.e., not 0 encryption )
or else man in the middle snooping is possible.

I am sure other issues will pop up.

Henry


Social Web Architect
http://bblfish.net/