On 4/21/05, Duane <[EMAIL PROTECTED]> wrote: > Tyler Close wrote: > > > This is incorrect. The petname tool does guard against DNS poisoning. > > The petname tool provides a reliable binding between an SSL identity > > and a user chosen reminder note. The petname tool does not rely on the > > correctness of DNS information. > > Actually your making the assumption the initial connection is to the > site you think it is,
Teasing apart exactly what that means is a fine art. Consider the case where I come across a new SSL site for an online entity. The site is interesting, so I create a new account and simultaneously assign a petname. From that moment forward, I know that I am interacting with the same site I first created the account with. Now, if the thing of value is my password, what does it mean to say the initial connection was spoofed? Who was it that I found interesting? It's also worth noting that for the moment, this question is largely academic. Pulling off a brain-in-a-vat attack is far beyond what phishers are currently attempting. A phishing attack tries to subvert an existing relationship, in order to exploit value created by others. For example, impersonating a bank in order to access an existing bank account. > which is the same assumption most people make with > SSH, unless you check fingerprints and do out of band checking you have > no way to know if you're assumption in that you think you know who > you're talking to really is one and the same... Having an automated way to check fingerprints would certainly improve things by enabling a richer set of introduction scenarios. For example, you could cross-reference links from multiple sources to see if they all refer to the same entity. For an implementation, see: http://www.waterken.com/dev/YURL/httpsy/ and more generally, all the papers under: http://www.waterken.com/dev/YURL/ Depending on how things go with modifying the HTTPS UI and integrating the petname tool, I'd like to further advance the secure linking features in Firefox. Regards, Tyler -- The web-calculus is the union of REST and capability-based security: http://www.waterken.com/dev/Web/ _______________________________________________ mozilla-crypto mailing list [email protected] http://mail.mozilla.org/listinfo/mozilla-crypto
