full-disclosure - Looking for some input

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

From: sjohnston at libertysite.com (Shannon Johnston)
Subject: Looking for some input

I posted this on the Dshield list a couple of days ago. Sorry to those of you who are seeing this again.

I'm looking for some input from the community at large on an issue that
has been bothering me for a while.

The institution where I do my banking has a login to an internet banking
page. While the login goes to an SSL enabled site, the login page is on
a non-SSL site. My question is: Doesn't this leave the members of the
institution open to phishing via DNS cache poisoning? Doesn't this
defeat the endpoint verification piece of an SSL certificate?

I'm looking for general input on this, so any replies are appreciated.

Thank you,
Shannon Johnston