Malicious Links

[mbays]

* Tuesday, 2021-07-13 at 16:29 +0000 - nervuri <nervuri@disroot.org>:

> https://gitlab.com/gemini-specification/protocol/-/issues/37

> A simple rule, roughly equivalent to SameSite=Strict, could be added to the spec to help prevent most instances of CSRF (Cross-Site Request Forgery). The rule can be something like:
>
> When following a URI which is in scope of a client certificate from a page (or via a redirect) outside of that scope, clients MUST prompt the user to activate the client certificate for the target URI.

"MUST prompt" seems too strong to me. For redirects an explicit prompt is necessary, but for just following a link into the scope of a new certificate, I think it is sufficient if the link to be presented in a way which makes explicit the precise URI and what certificate would be used for it. (This is how diohsc works currently, and I think it's fine.)