[
Lists Home |
Date Index |
Thread Index
]
---
> The category of truth-oblivious technically-vacuous trade press articles
> about XML is far from empty, but I think we have a major new star in the
> firmament.
I don't think so...
From the article:
---
> The trouble with XML is that it explains far too much about the data
that's
> represented in it. The tags that define the structure of a document and
> describe what each individual data element is also make it dead easy to
locate
> sensitive data, such as credit card and transaction information. This is
> simultaneously the basis of XML's power and its greatest weakness.
Hey, why not store the data in an encrypted manner, then run the encrypted
XML through an XSLT sheet and come out with the XML? Such as:
Begin with John D'oh entering:
] Name: John D'oh
] Pass: 12345
Now, the program encrypts the data through normal means and uses the
following XML (when unencrptyed)
] <xtyt><a>J</a><l n="254" /></xtyt> and so on....
Then the receiving app decrypts XML and runs it through an XSLT sheet to
get:
] <entry>
] <name>John D'oh</name>
] <password>12345</password>
] <date format="JimTime">12-13-3001</date>
] </entry>
And the sheet is processed through the processor. Where's the security
risk???
---
Jimmy Cerra
> -----Original Message-----
> From: Tim Bray [mailto:tbray@textuality.com]
> Sent: Wednesday, May 29, 2002 11:36 PM
> To: xml-dev@lists.xml.org
> Subject: [xml-dev] The sky is falling! XML's dirty secret! Go back! It's a
> trap!
>
> The category of truth-oblivious technically-vacuous trade press articles
> about XML is far from empty, but I think we have a major new star in the
> firmament.
>
>
http://www.computerworld.com/securitytopics/security/holes/story/0%2C10801%2
C7
> 1436%2C00.html
>
> Oh dear... -Tim
>
>
> -----------------------------------------------------------------
> The xml-dev list is sponsored by XML.org <http://www.xml.org>, an
> initiative of OASIS <http://www.oasis-open.org>
>
> The list archives are at http://lists.xml.org/archives/xml-dev/
>
> To subscribe or unsubscribe from this list use the subscription
> manager: <http://lists.xml.org/ob/adm.pl>
|
