Re: XML Protocols Shakedown

"Simon St.Laurent" wrote:

> At 04:10 PM 5/22/00 -0700, Larry Cable wrote:
> >Andrew Layman wrote:
> >
> >> Help me, please, to understand how this is specific to XML schemas.
> >

my interpretation of the "issue" is this; in a world where we are exchanging XML "messages" across
the internet that use "external" schema references in order to identify themselves, the message content
itself (and thus the nature of the service it provides) is more easily discoverable, since presumably the
schema itself shall be accessible via a URL. Therefore one could imagine that a hacker could create a
search engine that would trawl the internet for such schema definitions thus giving them valuable information
regarding the existence/nature of such XML-based "services" ...

I think this is a red herring, since we had better have a number of mechanisms in place in order to secure
such messages from attack other than by hiding the schema definitions from discovery!

In particular we need to (re)solve all the preexisting security issues of:
    - protocol participant authentication/authorisation
    - protecting protocol messages from tampering
    - preventing sensitive message "payload" from being interpreted by unathorised parties
    - ...


Rgds

- Larry Cable

>
> >it is'nt ...
>
> It sounds like a general claim for security-through-obscurity, maybe on the
> basis that shared 'anything with semantics' is dangerous.
>
> We could stop sharing...
>
> Simon St.Laurent
> XML Elements of Style / XML: A Primer, 2nd Ed.
> Building XML Applications
> Inside XML DTDs: Scientific and Technical
> Cookies / Sharing Bandwidth
> http://www.simonstl.com