bugtraq - Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 15 Feb 2005 09:12:34 +0100
From: Vincent Archer <var@...y-all.com>
To: David Schwartz <davids@...master.com>
Cc: bugtraq@...urityfocus.com,
	Scott Gifford <sgifford@...pectclass.com>
Subject: Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs.


On Sat, Feb 12, 2005 at 04:32:26PM -0800, David Schwartz wrote:
> > As a user of a browser I am not a customer of the CA, and it isn't
> > evident why the CA should be under any obligation to me.  They surely
> > are under an obligation to their shareholders and their customers.
> 
> 	Nonsense. The CA is asking for your trust and can only earn revenue based
> upon the number of people who trust it.

Wrong. The CA gains trust because it manages to get its certificate included
with the default package for major browsers.

It then has to persuade its customers (the server operators) to buy a
certificate. It does not have to persuade any user: trust is already
implied by the bundling.

-- 
Vincent ARCHER
varcher@...yall.com

Tel : +33 (0)1 40 07 47 14
Fax : +33 (0)1 40 07 47 27
Deny All - 5, rue Scribe - 75009 Paris - France
www.denyall.com