On 2011-03-10 22:07, Brian Smith wrote: > "Jean-Marc Desperrier" wrote:
>> The rule doesn't change so much : you still need to enter your >> password inside a secure element, ie if we teach user it's OK to >> enter their SRP password in a non secure GUI "because it won't be >> sent to the server" we loose. > > It's hard to explain what a "secure element" is to somebody. > It's much easier to say "make sure the address bar turns green > and says 'PayPal, Inc.'" but even that's asking too much most of the time. If you use PKI + PIN-code a PIN code given to a bad server through a spoofed GUI doesn't represent a major security issue since the bad guy has no use of it unless he has local access to your computer/token/SE. This is another reason why SRP is the wrong solution. Unfortunately NSS has no support for PIN provisioning through the browser so all this is mainly "theory" except for a few lucky who (for example) have a PIV card. Anders -- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
