bugtraq - Re: New whitepaper "The Phishing Guide"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 27 Sep 2004 10:26:08 -0400
From: Chip Andrews <chip@...security.com>
To: Daniel Veditz <dveditz@...zio.com>
Cc: bugtraq@...urityfocus.com
Subject: Re: New whitepaper "The Phishing Guide"

Agreed but forcing phishers to generate key pairs, purchase 
certificates, and/or buy-off CA vendor personnel creates additional 
audit trails that could help in the tracking and prosecution of those 
individuals. Combine this with certificate revocation and you have at 
least a model that gives more verification, auditing, and remediation 
than currently exists in the pursuit of these criminals. It's at least a 
step in the right direction and shouldn't be avoided simply because it 
won't immediately stop all phishing attacks or protect all users.

Watermarks do not stop all counterfeiting. Holograms do not stop all 
credit card fraud. It doesn't mean we shouldn't do what we can to help - 
even if its only a partial solution.

Chip Andrews
http://www.sqlsecurity.com

>How does that help in practice? A user fooled by a link to ebay-support.com
>is just as likely to accept signed mail from foo@...y-support.com. Not to
>mention that the potential profits from phishing could easily finance the
>purchase of a forged cert if someone at one of the built-in CA's was
>corruptible. Given the several that are based in 3rd world companies (not to
>mention recent US corporate scandals) I have no confidence that won't
>eventually happen.
>
>-Dan Veditz
>
>
>  
>