full-disclosure - Looking for some input

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <200405271817.i4RIHmOb002055@turing-police.cc.vt.edu>
From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks@...edu)
Subject: Looking for some input 

On Thu, 27 May 2004 10:40:17 MDT, Shannon Johnston <sjohnston@...ertysite.com>  said:

> The institution where I do my banking has a login to an internet banking
> page. While the login goes to an SSL enabled site, the login page is on
> a non-SSL site. My question is: Doesn't this leave the members of the
> institution open to phishing via DNS cache poisoning? Doesn't this
> defeat the endpoint verification piece of an SSL certificate?

Contemplate the real-world usefulness of an SSL cert.

No, seriously - consider Matt Blaze's comment that "A CA can protect you
against anybody they're not accepting money from" - then go read the chapter in
Schneier's "Secrets and Lies" about it.

Or as a faster check - how many people actually click on that little padlock,
read the "This site has correctly identified itself" blurb, and then go the
extra step of actually looking at the certificate to ensure it's not a spoofed
site that's correctly identified itself under the spoofed site name? (Hint -
would you notice if it said "The website www.g00gle.com has correctly
identified itself"?)  Oh - and do that for *every* encrypted page? ;)

If I can hijack your connection to your bank by poisoning your ISP's DNS cache,
I can do the exact same thing to hijack you to a typosquatter site that
correctly identifies itself as the typosquatter site....

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040527/dba60b0b/attachment.bin