InCommon Technical Discussions

["Cantor, Scott" <cantor.2@osu.edu>]

> So, maybe I missed something here (I have a cold today), but why do we care
> about the foreign site’s SSL grade?  Having SSL, yes, I can see that, but
> beyond that, if my institution wants to run SSLv1 with a 256K key signed by
> CNNIC, isn’t that a risk that only affects us?

Who is "us"? The IdP? Clearly your security affects me as an SP if I depend 
on your logins. If you're the SP, then I certainly care if I'm releasing data 
to you whether the site is actually doing weak TLS, particularly when 
encryption isn't used (and I don't think eduGAIN as a whole requires SPs have 
keys, does it?)

Mostly it's a barometer of incompetence.

Whether I would actually do something with this data if I had it, I don't 
know. In terms of my default release policy, I think I'd strongly consider 
it. Contract services have explicit release rules, but for ad hoc federation, 
yeah, I think I'd tell you to fix your site if you want our data.

Is this the highest priority for InCommon? No, but we're just talking here.

-- Scott

Attachment: smime.p7s
Description: S/MIME cryptographic signature