Sunday, October 22, 2006

Air travel protocol bindings

When you arrive in a country from another, but then have a connection on to another city in that same country, you generally have to retrieve your checked luggage from the first flight before clearing customs. You get your luggage, wait in a long line, get grilled by bored cops with control issues, and then drop off the luggage before boarding the connecting flight.

This sequence, in which the user takes temporary control over their luggage in between two separate secure channels (during which the luggage is stored safely in the holds of the two respective airplanes), feels much like the protocol flows that have identity tokens flowing through the browser. Both introduce a gap into the security context.

Specifically, the sequence most resembles those flows that rely on an HTML Form POST as the mechanism by which the handover happens – this because in this scenario, the user may be expected to actually do something to facilitate the transfer (depending on how they've configured their browser for Javascript).

Additionally, if upon arriving at your destination, your checked luggage doesn't - the baggage claim receipt plays (in a sense) the role of a SAML artifact for the luggage itself. Like the SAML Artifact Binding, you arrive without the 'token' but then present a claim ticket that facilitates its retrieval - allowing the the luggage to be eventually (hopefully) delivered to the relevant address.

1 comment:

Robin Wilton said...

I once had to connect at JFK between London and Buenos Aires... so on arrival at New York was told to retrieve my baggage and clear customs before changing terminals.

I did this, and then followed their guidance, which was to hand the case over at the transit baggage desk. Then I got on the shuttle bus between the terminals. At that point (I was a bit jet-lagged...) it occurred to me that I could have kept my case with me and checked it in myself at the departure terminal. Too late.

The case did actually arrive in Buenos Aires, but not until 2 days after me. The customers I called on in the meantime (immaculately attired Argentines) were incredibly polite about it, despite my increasingly tramp-like appearance.