15) If the form is submitted via GET request using HTTP, can a browser adversary (i.e., one who can locally observe the URLs requested by the user) obtain the password? True False 16) If the form is submitted via POST request using HTTP, can a network adversary obtain the password? True False

A "poison packet attack" is when someone throws a bunch of poison at someone. There are two examples of this kind of attack that you can give.

Give some examples of the many means through which a session may be taken over by an attacker. The question is how one would protect oneself against such an attack.

Suppose a user employs one-time passwords as above (or, for that matter, reusable passwords), but that the password is transmitted sufficiently slowly. (a) Show that an eavesdropper can gain access to the remote server with a relatively modest number of guesses. (Hint: The eavesdropper starts guessing after the original user has typed all but one character of the password.) (b) To what other attacks might a user of one-time passwords be subject?

Use built-in authentication and authorization services on the web server when a client requests access to restricted data. Which of the following two justifications for layered protocols do you find more convincing? Don't just make a claim without any evidence.

When a web client requests access to protected resources on a web server, demonstrate the implementation of native authentication and authorisation services. Layered protocols have two significant proponents: Provide specific evidence to support your assertions.

End-to-end encryption could be a problem for application-level proxies. Please offer a method for handling encrypted payloads via an application-level proxy.

What happens when a MAC (message authentication code) is utilised and an attacker tries to tamper with the Tag (the MAC) and the ciphertext while it is in transit? Explain why this attack can never succeed since the target's ability to identify a modified Tag/ciphertext ensures success.

End-to-end encryption decryption may be problematic for application-level proxies. Provide a solution that will allow an application-level proxy to transit a protocol whose payloads are encrypted.X

When a web client requests access to protected resources on a web server, demonstrate the implementation of native authentication and authorisation services. Layered protocols have two significant proponents: Provide specific evidence to support your assertions.