{"id":414,"date":"2006-03-19T10:18:56","date_gmt":"2006-03-19T18:18:56","guid":{"rendered":"\/?p=414"},"modified":"2019-03-06T09:11:03","modified_gmt":"2019-03-06T15:11:03","slug":"my-friend-the-attacker","status":"publish","type":"post","link":"https:\/\/www.identityblog.com\/?p=414","title":{"rendered":"MY FRIEND THE ATTACKER"},"content":{"rendered":"

In my recent post on Hardy Infocard Pioneers<\/a>, I refered to the fact that the first “attack” had been made on the site. Apparently, I wasn't clear enough about the fact that I saw this as a good thing <\/strong>– something I appreciated. That led to this comment from Rohan.<\/p>\n

\n

Hi Kim,<\/p>\n

An Attacker. thats a nice title, when the intention was not to \u00e2\u20ac\u0153attack\u00e2\u20ac\u009d but try to look at infocards from the other side. From another perspective altogether. Everybody seems to just nod heads when workflows and use case examples are explained. I have not seen many who have tried to disagree in the \u00e2\u20ac\u0153open\u00e2\u20ac\u009d.<\/p>\n

Well, I am trying to do just that. Not disagree, but to look at it from another angle, and talk to you about my discoveries. <\/p>\n

I\u00e2\u20ac\u2122m sure that youd\u00e2\u20ac\u2122 acknowledge, that I \u00e2\u20ac\u0153did\u00e2\u20ac\u009d inform you as soon as I logged into your site with FAKE info. Well, thats not called an \u00e2\u20ac\u0153attack\u00e2\u20ac\u009d.<\/p>\n

As far as the \u00e2\u20ac\u0153browsehappy.com\u00e2\u20ac\u009d link goes, thats just a joke\u00e2\u20ac\u00a6<\/p>\n

Like you said : All of us will be attacked and all of us have to work hard – and together – to create a safe internet. I AGREE with you. 100%. But lets be open to ideas that may be contradictory to our own\u00e2\u20ac\u00a6.. My efforts are to create a SAFE internet. To point out issues and errors, so that one may work on fixing them. <\/p>\n<\/blockquote>\n

So let me set the record straight. I think Rohan is making a positive contribution to thinking about InfoCards. I appreciate what he is doing for the very reasons he expresses. And if you go to his site, you'll see how creative he is.<\/p>\n

I didn\u00e2\u20ac\u2122t mean \u00e2\u20ac\u0153attacker\u00e2\u20ac\u009d in the \u00e2\u20ac\u0153normal\u00e2\u20ac\u009d sense of the word – I was talking about THE ATTACKER ROLE we refer to as identity and security people, when we attempt, as he did, to think things through from the viewpoint of an attacker<\/em>. <\/p>\n

I am delighted to have others in the community thinking through the possible attacks with me. More about that in a minute.<\/p>\n

In terms of the browsehappy.com thing, it was obvious that Rohan was poking fun – and that's fine. I just appreciated the opportunity to rail, en passant, against a couple of the site's more dubious claims.<\/p>\n

This said, I'd like to be very clear about the status of the work I'm doing here to InfoCard-enable my site.<\/p>\n

There are two parts to this project.<\/p>\n

The first is pretty much complete, and involved developing a way to consume and verify InfoCard SAML tokens using a typical LAMP server without installing binaries.<\/p>\n

The second is the part I'm working on now. It involves experimentatng with how to use InfoCards concretely from a web site – in this case my blog. I'm learning as I go. After all, InfoCards are a relatively recent arrival on the scene…<\/p>\n

I'll publish various elements of code as it evolves – but I'm writing this stuff personally as an exploration – it isn't a product, doesn't yet have a formal threat analysis, hasn't gone through security reviews, and hasn't even been seen by anyone other than me before appearing here. What you see is what you get.<\/p>\n

My thinking is that the security threat model and reviews will be done here as part of the blogoshere process. And no doubt we'll find things to fix, working as a team.<\/p>\n","protected":false},"excerpt":{"rendered":"

Thinking from the viewpoint of the “attacker” is essential to developing a security and privacy threat analysis. I take this work as being a positive contribution.<\/p>\n","protected":false},"author":68,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[2],"tags":[],"_links":{"self":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/414"}],"collection":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/users\/68"}],"replies":[{"embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=414"}],"version-history":[{"count":1,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/414\/revisions"}],"predecessor-version":[{"id":1723,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=\/wp\/v2\/posts\/414\/revisions\/1723"}],"wp:attachment":[{"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=414"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=414"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.identityblog.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=414"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}