Re: [xml-dev] 2007 Predictions

[Richard Salz <rsalz@us.ibm.com>]

>  - protected from nake eye inspection of actual data HTTP move

Yes.  In another post I say that this is all you get.

>  - validate server identity, that can serve to avoid phising or DNS 
spoofing.

Maybe.  If I can get a cert from one of the common vendors that "looks 
like" the name being spoofed, the no.

>  - protected content from malware javascript/html inyection

Yes, but I don't think this is concern anyway.  Are there any real 'man in 
the middle' attacks today?  So this is really the same as 'validate 
identity'

>  - validate client identity? (not idea about this, but I think is 
posible)

Yes, it is possible.

>  - cypher is strong against brute force

This is really the same as #1.

>  - cypher strong against password distribution problem (PKI dont need
> that ...much)

> Other than that. Again. Maybe was not soo a good idea, cause people
> want fast porn. Not safe or private porn. Wait... bad analogy.

Funny.

        /r$

--
STSM
Senior Security Architect
DataPower SOA Appliances