search

erasmus-without-paper / ewp-specs-api-discovery

Specifications of EWP's Discovery API.
MIT License
3 stars 1 forks source link

Problem with hosting certificates? #3

Closed wrygiel closed 8 years ago

wrygiel commented 8 years ago

@richared wrote:

Allowing clients to host their own certificates (unlike in EMREX where they are stored in a trusted repository) opens for easy manipulation or attacks which none has control of or can even detect. This needs to be looked more into detail by the WP concerned with security, before any conclusions are made.

wrygiel commented 8 years ago

Could you please provide an example attack scenario which (a) is possible in this architecture, and (b) is not possible in EMREX architecture?

As far as I remember, EMREX registry is being served in a very similar fashion, but it is being updated by sending an email to the registry administrator, while our registry will be updated by changing the manifest file. Is this the only difference?

wrygiel commented 8 years ago

BTW - https://github.com/erasmus-without-paper/ewp-specs-architecture/issues/2 - we will probably be hosting public keys (instead of certificates). But I guess this doesn't change things much.

wrygiel commented 8 years ago

There was some further discussion on this in Oslo, but - thus far - no security issues were found with the current approach.