securing RPC access about beaker

[pfrazee]

Step 1 is a permissions prompt. Step 2 is hosting app code on signed hash logs, for versioning and integrity checks. Step 3 is software certificates by auditors, possibly a web-of-trust system

On Jun 6, 2016, at 4:15 PM, wanderer [email protected] wrote:

currently the way several decentralized systems (ethereum, ipfs) work with browser is to expose an RPC that is running locally. The problem with this a currently implemented is that any page could access those RPCs and do malicious things (ex. a page could access ipfs's rpc and pin some child porn).

I don't know the best way to secure this. But it would be nice to have some way to selectively expose RPCs to the pages.

—
You are receiving this because you are subscribed to this thread.
Reply to this email directly, view it on GitHub, or mute the thread.

[wanderer]

how would step 1) work? Lets say we just want to drop in IPFS. It doesn't have any built mechanism to selectivily expose it's RPC to pages. So we have to have some sort of container around IPFS (or any other locally running http based RPC) that can control what is exposed and do things like permissions promets, i think...

[pfrazee]

Yeah we might do it that way. I dont think it'll be difficult.

[genecyber]

Have you looked into Capn'Proto for rpc?

[wanderer]

how could Capn'Proto be used for existing RPCs?

[genecyber]

I haven't investigated it deep enough yet to be able to answer that, simply
wanted to point it out of you hadn't seen it yet.

On Wednesday, June 15, 2016, wanderer [email protected] wrote:

how could Capn'Proto be used for existing RPCs?

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
#1 (comment), or mute
the thread
https://github.com/notifications/unsubscribe/AAK8ok2vQJIox82vuDEfARMCMrhzXVvsks5qMDUzgaJpZM4IvaIM
.

[alspore]

Permissioning could be achieved by creating a whitelist of domains that have access to various sandboxed protocol apis. We could display an interface similar to existing ad blocker browser extensions when a page tries to access protocols outside its previous permission state. I imagine some kind of alert box that has the option to allow specific protocols on a per page, or per domain basis. Permissions could also be set before page load based on arbitrary out of band authentication schemes.

[pfrazee]

@5paceManSpiff that's what I'm thinking