Re: Security hole: Digital Signing + Downloadable fonts

[Barbara Jennings <bjjenni@xxxxxxxxxxxxxxxxx>]

As with other newly introduced technologies, this sounds as though
there is need for a "How to.. " document.  In which for example, one
may find the strong recommendation to sign for $amounts that are
written both numerically and textually as on a standard bank check
or draft document.


> > 
> >  My guess is that people generally  want to sign their own material 
> >  produced on their PC, and not web pages and similar things downloaded 
> >  from anywhere.
> >  To tell the truth I do not see any reason to do that.
> > 
> 
> That's not the way I read the problem.  Imagine a signed document served
> up by a web server that says "you agree to pay $50023" but the line is in
> a FONT command that tells your browser to display it in a particular font,
> also on the web server.  Now, that font could do a mapping that translates
> all 5's and 0's into spaces.  When you see the line in your browser then,
> you'll read "you agree to pay $   23".