Shibboleth Developers

[Scott Cantor <>]

> I wasn't concerned with behind the scenes activity, but rather
> withh direct compromise of the session cookies on the browser.

But what fix are you suggesting, exactly? I don't think the software is
misrepresenting this anywhere...

Supporting session boundaries is a convenience for deployers who want to
have different configurations, but it's not a privacy feature or connected
in any direct way to attribute release policy.

BTW, I hope you're around when the portal discussions happen, since the
amount of impossible privacy sandboxing that's come up in those discussions
drives me crazy. ;-)

-- Scott