Secure Mashups: CSRF-resistent alternatives to WebID

by Dan C at Tuesday, July 26, 2011
I think WebID is headed in the wrong direction. It separates authorization from authentication, which is widely believed to be a good practice, but proves spectacularly bad practice when it leads to cross-site request forgery.  I have tried to explain my misgivings to the WebID proponents, but I didn't have much in the way of an alternative to suggest. Until today, when I found Sitelier and Belay Research.

While evaluating Spring Security today, I went looking to see if it its role-based architecture is in any way compatible with capability-based approaches and I found this, from the Sitelier guys:

In our view, the web right now is backwards: users have accounts on dozens of websites, all with their own logins and passwords, and our content and personal information is scattered all over the web, out of our control. Sitelier turns the situation around: when you install an app, you're effectively creating an account on your site for the app, which can then save its data (your data) there, so all your online information can live in one secure location that you control.
Replies pointed out related work such as Belay Research and emphasized usability research. Indeed, my understanding since at least as far back as my Dec 2008 post is that the capability approach is the necessary and sufficient solution to the problem of secure mashups; the only question is: given the worse-is-better tendency in software deployment, is there any chance we can move the state-of-the-art that far?

There are also some market forces to consider. If I host my own email, how do get sub-second search a la ad-powered gmail?


Labels: , ,

2 comments:

  1. Dan, The Sitelier type application is exactly what WebID is designed for. Look at the video "WebID and Browsers" on http://webid.info/ . For a full explanation see "The Philosophy of the Social Web" video http://bblfish.net/tmp/2010/10/26/ . So the idea is for you to have your own box that contains all those applications. It is the same vision the http://freedomboxfoundation.org/ espouses.

    But it order to do that you need to be able to have a distributed social web, with links between people, so that a web of trust between freedom boxes can be established.

    To secure Xside forgery one should of course have the URLs of important formst be one time only. But I think that is a different issue altogether.

    ReplyDelete

  2. Yes, I realize the Sitelier application is what WebID is designed for. But I think WebID goes about it the wrong way, i.e. using access controls rather than capabilities. My research suggests that the CSRF issue is not separable at all.

    ReplyDelete

Thoughtful contributions are welcome; some comments are moderated.

Subscribe to: Post Comments (Atom)