On Dec 6, 2007, at 10:36 PM, Scott Kitterman wrote:
On Friday 07 December 2007 00:46, Steve Atkins wrote:
The first step would be a group consensus on what the threats
are ("what SSP is supposed to be for"), or at least a superset of
what most people think.
Anyone? Bueller?
I, for one, feel like we did this in great depth during and before the
requirements development. My suggestion would be to look to the
work we've
already done and refresh your memory on the established consenses.
I recall two suggestions from there. Neither were considered in any
depth.
1. Domain forgery. That's not a "threat". It's an intermediate step,
at most.
2. Phishing.
So that's.... one.
Got any others?
Cheers,
Steve
_______________________________________________
NOTE WELL: This list operates according to
http://mipassoc.org/dkim/ietf-list-rules.html