bugtraq - Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <42127018.4070200@helsinki.fi.eu.org>
Date: Tue, 15 Feb 2005 23:56:40 +0200
From: Sebastian <security-basics@...sinki.fi.eu.org>
To: "Thor (Hammer of God)" <thor@...merofgod.com>
Cc: Vincent Archer <var@...y-all.com>, bugtraq@...urityfocus.com,
	Scott Gifford <sgifford@...pectclass.com>,
	David Schwartz <davids@...master.com>
Subject: Re: International Domain Name [IDN] support in modern browsers allows
 attackers to spoof domain name URLs + SSL certs.



A quick (and very non-scientific) thought: Do you have trust in the 
issuer of your CC?
Do you trust a shop that has "Your major CC accepted" posted on the door?
Do you trust someone that can't provide the means to verify that trust, 
with or without the sign?
Do you, as an average tourist, even know how you could check it?

I would think that the answer lies in one of those questions..

 -Sebastian




Thor (Hammer of God) wrote:

>>> Nonsense. The CA is asking for your trust and can only earn revenue 
>>> based
>>> upon the number of people who trust it.
>>
>>
>> Wrong. The CA gains trust because it manages to get its certificate 
>> included
>> with the default package for major browsers.
>>
>> It then has to persuade its customers (the server operators) to buy a
>> certificate. It does not have to persuade any user: trust is already
>> implied by the bundling.
>
>
> Of course the CA has to gain the trust of the users... There are many 
> uses for client-based certificates: code signing, user verification, 
> email encryption, automatic mapping of user account to personal 
> certificates, blah blah blah.  The business model of commercial CA's 
> is most certainly not limited to server operators only.   While 
> personal certificate stores come with pre-trusted root certificates 
> from many CA's to automatically trust many server-based functions, 
> there is a vast market for client certs.
>
> T




-- 
No virus found in this outgoing message.
Checked by AVG Anti-Virus.
Version: 7.0.300 / Virus Database: 265.8.8 - Release Date: 14/02/2005