bugtraq - Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 17 Feb 2005 01:19:06 +0100
From: Stefan Paletta <stefanp@...al1.com>
To: bugtraq@...urityfocus.com
Subject: Re: International Domain Name [IDN] support in modern browsers allows
	attackers to spoof domain name URLs + SSL certs.

Sebastian wrote/schrieb/scripsit:
>A quick (and very non-scientific) thought: Do you have trust in the 
>issuer of your CC?
>Do you trust a shop that has "Your major CC accepted" posted on the door?
>Do you trust someone that can't provide the means to verify that trust, 
>with or without the sign?
>Do you, as an average tourist, even know how you could check it?
>
>I would think that the answer lies in one of those questions..

The key difference between a CA and a CC company is that the latter 
takes part in the actual business transaction between the parties.
The customer does not have to trust the CC company to certify the shop 
because he can demand the CC issuer to do a chargeback with almost no 
questions asked.

The CC system also works in a way that is safe as long as customers 
apply common sense, which they are expected to do. It still needs to be 
figured out how to make common sense work for public key crypto on the 
other hand.

-Stefan
-- 
 junior guru   SP666-RIPE     JID:stefanp@...ber.de.cw.net    SMP@IRC