Re: U2F Demo

On fös 30.maí 2014 14:25, Dave Longley wrote:
> 3. If your browser can't yet obscure information about the relying party
> from your Identity Provider, a trusted "login mixnet" can be provided to
> intermediate communication between your Identity Provider and the
> relying party in order to protect your privacy.
An interesting notion, but what makes the mixnet trustworthy? You're
already trusting downloaded code with identifying the identity provider.
Why can't that also mediate between the IdP and RP? Security depends on
IdP-provided signatures, not a direct conversation between the IdP and RP.

With greetings,
  Herbert Snorrason