> However, if the attacker has the ability to eavesdrop, then for
> either mechanism, he can just wait until the server sends the
> resource representation, and read it directly off the wire.
> There's no need to get either the secret URL or the user/password.

Hah, that's very true! :)

> I suggest you develop several use-cases for RNA and then decide
> what types of attackers you wish to defend against. Otherwise, you
> are just wasting your time.

Good advice, that sounds like a more robust way to evaluate the security
of the specification.

Michael Day

--
YesLogic Prince prints XML!
http://yeslogic.com/prince