Ka-Ping Yee wrote:
On Wed, 2 Nov 2005, Julien Pierre wrote:
The account (or other relationship) you previously established at the
website you wanted -- the "one truly intended" as you put it. The
phisher wants to fool you into believing you are participating in that
relationship when in reality you are dealing with an impostor. By
keeping note of the certificate information, your browser can tell you
reliably whether you are dealing with the same site and not an impostor.
No. A party is allowed to use more than one certificate, for reasons
such as renewal, or many other. There is nothing in
X.509 or SSL that says one party only has one cert, quite the contrary.
The fact that the certificate has changed since your last
communication does not tell you that you aren't dealing still with the
same site .
If you used that logic, and you were fooled the first time into
accepting the cert, you will be fooled again the second time and be
talking with the same impostor.
Assuming your IM protocol is encrypted, somehow when your IM client
talks to an IM server, or to an IM peer, it needs to verify the identity
of that server or peer before logging in. Encryption buys you nothing if
your client encrypts to the wrong party.
Your buddy list should record the key that was used last time and identify
the other party by the fact that it is using the same key this time.
That assumes you weren't fooled the first time, and the peer always uses
the same key. Some protocols might have the later attribute, but you
would still need to solve the first problem of the initial verification.
_______________________________________________
mozilla-crypto mailing list
mozilla-crypto@mozilla.org
http://mail.mozilla.org/listinfo/mozilla-crypto
