{"action":"created","issue":{"url":"https://api.github.com/repos/mozilla/browserid-local-verify/issues/19","labels_url":"https://api.github.com/repos/mozilla/browserid-local-verify/issues/19/labels{/name}","comments_url":"https://api.github.com/repos/mozilla/browserid-local-verify/issues/19/comments","events_url":"https://api.github.com/repos/mozilla/browserid-local-verify/issues/19/events","html_url":"https://github.com/mozilla/browserid-local-verify/issues/19","id":23828392,"number":19,"title":"Defend against hostile IdPs with too many keys","user":{"login":"fmarier","id":167821,"avatar_url":"https://avatars.githubusercontent.com/u/167821?v=3","gravatar_id":"","url":"https://api.github.com/users/fmarier","html_url":"https://github.com/fmarier","followers_url":"https://api.github.com/users/fmarier/followers","following_url":"https://api.github.com/users/fmarier/following{/other_user}","gists_url":"https://api.github.com/users/fmarier/gists{/gist_id}","starred_url":"https://api.github.com/users/fmarier/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fmarier/subscriptions","organizations_url":"https://api.github.com/users/fmarier/orgs","repos_url":"https://api.github.com/users/fmarier/repos","events_url":"https://api.github.com/users/fmarier/events{/privacy}","received_events_url":"https://api.github.com/users/fmarier/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2013-12-06T00:03:25Z","updated_at":"2015-09-16T08:53:02Z","closed_at":"2015-09-16T08:53:01Z","body":"If an IdP wanted to DoS a verifier, it could for example provide 1000 pubkeys and therefore significantly increase the time it takes a verifier to check the signature on an assertion.\r\n\r\nI suggest we defend against these attacks by only looking at the first 10 keys."},"comment":{"url":"https://api.github.com/repos/mozilla/browserid-local-verify/issues/comments/140675740","html_url":"https://github.com/mozilla/browserid-local-verify/issues/19#issuecomment-140675740","issue_url":"https://api.github.com/repos/mozilla/browserid-local-verify/issues/19","id":140675740,"user":{"login":"rfk","id":34695,"avatar_url":"https://avatars.githubusercontent.com/u/34695?v=3","gravatar_id":"","url":"https://api.github.com/users/rfk","html_url":"https://github.com/rfk","followers_url":"https://api.github.com/users/rfk/followers","following_url":"https://api.github.com/users/rfk/following{/other_user}","gists_url":"https://api.github.com/users/rfk/gists{/gist_id}","starred_url":"https://api.github.com/users/rfk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rfk/subscriptions","organizations_url":"https://api.github.com/users/rfk/orgs","repos_url":"https://api.github.com/users/rfk/repos","events_url":"https://api.github.com/users/rfk/events{/privacy}","received_events_url":"https://api.github.com/users/rfk/received_events","type":"User","site_admin":false},"created_at":"2015-09-16T08:53:01Z","updated_at":"2015-09-16T08:53:01Z","body":"This repo is maintenance-only at this point; closing out old feature/enhancement bugs"}}