<html><head><style>body{font-family:Helvetica,Arial;font-size:13px}</style></head><body style="word-wrap:break-word;line-break:after-white-space"><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px;color:rgba(0,0,0,1.0);margin:0px;line-height:auto">On July 23, 2017 at 2:44:01 PM, Haravikk (<a href="mailto:opensim@haravikk.me">opensim@haravikk.me</a>) wrote:</div> <div><blockquote type="cite" class="clean_bq" style="font-family:Helvetica,Arial;font-size:13px;font-style:normal;font-variant-caps:normal;font-weight:normal;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px"><span><div><div></div><div>While reading about the Hypergrid I stumbled upon the following wiki page, detailing ideas on how to protect against malicious regions screwing with an avatar's inventory:<br><a href="http://opensimulator.org/wiki/Hypergrid_Inventory_Access">http://opensimulator.org/wiki/Hypergrid_Inventory_Access</a><br><br>I wanted to ask what the state of this is; the last real edit was 2009 so perhaps it's not an issue anymore? However I couldn't find anything obvious showing that the issue was ever resolved, or if trust of a hyper grid region remains a crucial factor (i.e- is following a hyper grid link you don't trust still a bad idea)?<br><br><br>I just wanted to point out that there is I believe a better solution than those proposed for protecting against this issue; basically, every user account in a hyper grid enabled setup would be give a certificate (asynchronous key), which would be sent to (or fetched by) a compatible viewer during login. Such viewers will then use this key to sign all inventory related requests that they make, thus when a region passes the request along to their inventory server, the inventory server can confirm that the request was not tampered with before carrying out it.<br><br>This would make it impossible for a region to send a request to do anything that the user did not specifically ask it to do; so in the example of worst-case example of a malicious simulator downloading a user's entire inventory then wiping it, it would be impossible without the user actually requesting (and thus generating signed requests for) those specific actions.<br><br>The downside of this solution is that it would take time to propagate as inventory servers would need to be upgraded with the new key-handling version, and users would need to start using viewers that support the key-handling as well. However, once this is sufficiently common it could simply be made the default (i.e- unsigned requests are always rejected) and the hyper grid would be safe from this form of abuse. There are likely other areas where this could be provided to give the same kind of protection.<br><br><br>Also, apologies if it seems like I'm raising lots of separate issues; a key theme that I'm interested in are issues of trust in security, so things like this jump out and me, and it's an area where I have a reasonable amount of experience (I wrote an implementation of AES in LSL just to make my services more secure 😉)</div></div></span></blockquote></div><p>Interesting idea, but not all the messages you’re talking about come directly from the viewer. UpdateCreateInventoryItem, for example, is sim -> data server and SaveAssetToInventory should never be accessible to the viewer. Some of the packets are already pretty dense as well and can’t afford to have a signature attached to them. (I also believe you mean asymmetric key, not asynchronous.)</p></body></html>