3 ms·
> And "caveat emptor" is not the threat model you can get away with on the web. Caveat emptor is not a threat model, it is a risk mitigation. It is arguably t
by 9wzYQbTYsAIc 4y ago
> And "caveat emptor" is not the threat model you can get away with on the web.
Caveat emptor is not a threat model, it is a risk mitigation.
It is arguably the only mitigation directly in the hands of the consumer.
And that the modern phrase is from a 2000+ year old “dead language” should certainly speak to the longevity, utility, and effectiveness of that mitigation.
> it would be great for me as a dev if I could just disavow responsibility for cross site scripting attacks and other attempts to misuse the user's credentials
thankfully there are standards and RFC’s that indicate best practices that recommend that these security risks be considered and mitigated
edit: see Rich Authorization Requests <https://www.ietf.org/archive/id/draft-ietf-oauth-rar-18.html https://www.ietf.org/archive/id/draft-ietf-oauth-rar-18.html> for the “work in progress”
- vintermann 4y agoWhen you run a service on the web, it's not enough to protect yourself. You must protect your users to the best of your ability. Threats against your users must be part of your threat model. If not, you won't keep them. They will leave. And saying "caveat emptor" will be about as effective at preventing that as saying "wingardium leviosa".
- 9wzYQbTYsAIc 4y ago> When you run a service on the web, it's not enough to protect yourself Nothing but agreement there. Can you identify a specific recommendation by the IETF or W3C that was ignored, in this case? > And saying "caveat emptor" will be about as effective at preventing that as saying "wingardium leviosa". I had to look up that apparent reference to Harry Potter, but I disagree. Educating your users about phishing risks, aka “caveat emptor” in this context, is explicitly a best practice for mitigating these kinds of security risks on the open web.