Talking Firefox security with Mozilla's Window Snyder

TalkBack 9 of 10:

Next »

« Previous

• Thread View
• Flat View

RE: Talking Firefox security with Mozilla's Window Snyder

Cross site XHR should not pass cookies but rather be able to only access publically available information. I had high hopes for Firefox when they pulled it from the beta. I was hoping they would follow the IE model and refuse to pass cookies. Cross site XHR that passes cookies pretty much enables the idea of client side proxies for malicious web servers to retrieve private information from other sites.

There is already a mechanism for one site to access the private information from another site- federation and web services. That way the two sites can authenticate each other as well as the client. Sure, it requires more work, but that is the right way to do it. By cowtailing to the flawed w3c standard firefox is enabling web developers to use inherently risky techniques for sharing information and I think it is evident that security, while important, still takes a back seat for the org. It is effectively the same thing as providing plain old strcopy to developers because it is just to much work for them to specify the maximum buffer length. It can be used correctly, but it is much better for the only option to be the more secure option.

Posted by: joshbw   Posted on: 08/07/08 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• VMware Infrastructure: A Guide to Bottom-Line Benefits VMware Frustrated by the costs of maintain ever larger data centers?or building ... Download Now
• Five Steps to Determine When to Virtualize YourServers VMware Server virtualization isn't just for big companies. Entry-level ... Download Now
• Server Consolidation and Containment With Virtual Infrastructure VMware To meet the constant demand to deploy, maintain and grow a broad array of ... Download Now