If we don’t even trust Carol to correctly report the user’s choices in the example
above, we could elaborate this further by having the trusted renderer hand Carol
a capability which proves that the user did indeed click on the capability she is
now handing to Bob, and Bob could decline to act unless he sees that capability.
No comments:
Post a Comment