Thanks - I hadn't heard of this RFC before. It's a bit unfortunate that you can't mandate security in the URL like you can in https, though - that destroys security against an active attacker. Their argument about why it isn't a problem is nonsense - they assume that the URL will arrive over an unauthenticated channel, and there's no reason to assume that.
Googling around, it looks like Eric Rescorla has found other serious problems. Damn, I was optimistic there.
![[personal profile]](https://www.dreamwidth.org/img/silk/identity/user.png)
timeasmymeasure
no subject
Date: 2007-02-24 09:18 am (UTC)Googling around, it looks like Eric Rescorla has found other serious problems. Damn, I was optimistic there.
http://mailman.mit.edu/pipermail/saag/2001q4/000256.html