Re: PKI too confusing to prevent phishing, part 28

2005-09-28 Thread dan
snipped | | Talking about users as being able only to hold one bit continues an | unfortunate attitude that, if only users weren't so dumb/careless/whatever, | we wouldn't have all these security problems. | | This is an important point. In November, 2003, the Computing Research

Re: PKI too confusing to prevent phishing, part 28

2005-09-27 Thread John Levine
In article [EMAIL PROTECTED] you write: http://www.informationweek.com/story/showArticle.jhtml?articleID=171200010 Summary: some phishes are going to SSL-secured sites that offer up their own self-signed cert. Users see the warning and say I've seen that dialog box before, no problem, and

Re: PKI too confusing to prevent phishing, part 28

2005-09-27 Thread Steven M. Bellovin
In message [EMAIL PROTECTED], Jerrold Leichter writes: Talking about users as being able only to hold one bit continues an unfortunate attitude that, if only users weren't so dumb/careless/whatever, we wouldn't have all these security problems. This is an important point. When *many* people

Re: PKI too confusing to prevent phishing, part 28

2005-09-27 Thread Bill Frantz
On 9/25/05, [EMAIL PROTECTED] (Paul Hoffman) wrote: http://www.informationweek.com/story/showArticle.jhtml?articleID=171200010 Summary: some phishes are going to SSL-secured sites that offer up their own self-signed cert. Users see the warning and say I've seen that dialog box before, no

Re: PKI too confusing to prevent phishing, part 28

2005-09-26 Thread Paul Hoffman
At 8:53 AM +0200 9/26/05, Amir Herzberg wrote: Is PKI the cause of this? I think not. This is a usability problem. We try to fix this problem (and similar problems) with TrustBar. Indeed we even had incidents where people on the TrustBar team itself, and some security experts using TrustBar,