Shibboleth Developers

["Scott Cantor" <>]

> The obvious threat scenario that address checking protects against is 
> theft of the bearer assertion from the client machine, with the just as 
> obvious reply that if the client machine is compromised in such a way that

> things passing through it can be stolen, then the user has pretty much 
> lost the game, regardless of protocols techniques.

No, the threat I worry about is cookie theft, which is much easier. Browsers
don't do a good job of protecting against that, bugs there crop up
constantly. An IP check is an order of magnitude harder to beat than
exploiting the bug of the week in IE is.

-- Scott