Le Sunday 18 April 2004 � 20:56:02, Peter Williams a �crit: > if muscle allows SCardControl to send proprietary comands to the CCID > driver support an IFD, then its possible that a rogue IFD will forward > inappropriate commands, or even generate inappropriate commands, to > reconfigure the reader's firmware.
> Windows took care of the general exposure introduced by unintepreted > commands by requiring explicit configuration of the trust level, by the > operator - requiring install scripts to explictely turn on the APIs support > for passing uninterpreted commands through SCardControl. We may wish to do > the same, using appropriate UNIX/muscle traditions. Good idea. It is very easy to add a configuration option in the Info.plist file of the driver. If I understood correctly it is possible to use synchronous cards with some readers by sending specific and proprietary commands using the CCID Escape command. This should be done through SCardControl. So if you want to use an application with synchronous cards you have to allow the use of the CCID Escape commands and then you have to open the door to "possibly malicious firmware download". The driver configuration option is not perfect is but better than nothing. Regards, -- Dr. Ludovic Rousseau [EMAIL PROTECTED] -- Normaliser Unix c'est comme pasteuriser le camembert, L.R. -- _______________________________________________ Muscle mailing list [EMAIL PROTECTED] http://lists.drizzle.com/mailman/listinfo/muscle
