Problems with Same Origin Policy (Transcript of Discussion)

Abstract

Basic point, if you want to enforce the same origin policy, you have to be able to authenticate origin. In many cases, as you will see, one might be unable to do so for whatever reasons. But you might still be able to authenticate yourself, and that could be a useful security primitive, and that is one of the purposes of this talk, to discuss this security primitive of knowing yourself. I will use examples from web application security (which some of you might be much more familiar with than myself) to illustrate this point, and I could quite often refer to mobile network security, I see great similarities.