bugtraq - RE: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 16 Feb 2005 03:48:12 -0800
From: "David Schwartz" <davids@...master.com>
To: <var@...y-all.com>
Cc: <bugtraq@...urityfocus.com>,
	"Scott Gifford" <sgifford@...pectclass.com>
Subject: RE: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs.



> On Sat, Feb 12, 2005 at 04:32:26PM -0800, David Schwartz wrote:

> > > As a user of a browser I am not a customer of the CA, and it isn't
> > > evident why the CA should be under any obligation to me.  They surely
> > > are under an obligation to their shareholders and their customers.

> > 	Nonsense. The CA is asking for your trust and can only earn
> > revenue based
> > upon the number of people who trust it.

> Wrong. The CA gains trust because it manages to get its
> certificate included
> with the default package for major browsers.

	Correct. And the browser vendors gain trust because they only include
reputable CAs.

> It then has to persuade its customers (the server operators) to buy a
> certificate. It does not have to persuade any user: trust is already
> implied by the bundling.

	How do you think you get the bundling?

	To put it another way, what would happen if a CA violated the trust? If the
vendors didn't immediately ship patches to remove the untrustworthy CA,
there would be a great oppurtunity for third parties to do so, and rest
assured they would. Immediately.

	This is no different than the case of Burger King buying inferior beef.
While it's true the beef vendor only has to convince Burger King to buy the
beef, not Burger King's customers, there wouldn't be any customers as soon
as they found out that Burger King was reselling food made from inferior
beef.

	This is just like any other indirect relationship. Buyers never want poor
quality raw materials because they result in poor quality finished goods.

	DS