5 ms·
What I'm talking about here is a malicious service (Relying Party) that provides his own malicious BrowserID client to the user. Web services or mobile apps oft
by BenoitEssiambre 14y ago
What I'm talking about here is a malicious service (Relying Party) that provides his own malicious BrowserID client to the user. Web services or mobile apps often provide their own clients. If the user's private key is leaked to a malicious RP when the user logs in this RP, can't it generate fake identity assertions (using the leaked key) to use along with the user certificate to login to any other Persona account? The faked identity assertion can claim to be for any service.
- anonymoushn 14y agoAh, yes, a valid user certificate and the corresponding private key would allow you to impersonate the user for other RPs for the duration of the cert. That is troublesome. Edited more: If you ship the user a malicious client and the user runs it, you can just keep his email password. This probably grants you access to all of his accounts for longer than the cert would last anyway. If the user uses 2-factor auth, the private key + cert combo is more useful than the password though.
- lukeh 14y agoHaving a browser native client will help.