On Sun, 22 Jul 2007, Steven M. Bellovin wrote: > > Yes, they can change it, but they can't change it without being caught. also assuming your application understands a non-signed vs signed response... no apps currently do, aside from the FireFox plugin supported (I think) by Sparta still?