Is it ASCII or Protobuf? The importance of types in cryptographic signatures
That's a fairly big problem I hadn't read about before, with great writing. But I don't think the proposed solutions are realistic.<p><pre><code>  [...] all those web sites must use exactly the same format for 
  authentication challenges.

  [...] the key cannot be used for any automated purpose [...]

  [...]  all applications which use the key for signing must include
  such a context string, and context strings must be chosen to avoid conflicts.

  [...] better than either of the above is to use a different key for each purpose.
</code></pre>
That's shifting protocol problems to standardization and human caution. It may work, but I'm skeptic.<p>Maybe a change in the cryptographic protocol can fix the problem? For example, instead of<p><pre><code>    Server: server_value // domain + action + nonce + ...
    Client: sign(server_value)
</code></pre>
we use<p><pre><code>    Server: server_value
    Client: sign(client_random) + sign(server_value XOR client_random)
</code></pre>
and the server verifies that the two signed components, when XOR'd, result in the same value sent. This way the client only signs random data but can still authenticate.<p>This is not supposed to be a final solution, and is likely to have flaws, but I think it's a better direction to pursue.