Shibboleth Developers

[Nate Klingenstein <>]

 Jim,

They're encrypted for both legs of the transaction, but because there is 
no encryption of the response or assertion themselves, the attributes 
pass through the browser and the client in cleartext.  Some have 
concerns about malware, privacy on shared computers, or the sharing of 
attributes that were not meant to be revealed to the principal.  I find 
such concerns understandable, myself.

Take care,
Nate.

On 2010-08-26 04:43, Jim Fox wrote:
> I have never understood this concern.  If one uses https always aren't the 
> pushed attributes encrypted?
>
> Jim