Ian Grigg wrote:
Too many words? OK, here's the short version
of why phising occurs:
Browsers implement SSL+PKI and SSL+PKI is
secure so we don't need to worry about it.
PKI+SSL *is* the root cause of the problem. It's
just not the certificate level but the business and
architecture level.
Ben Laurie wrote:
Ian Grigg wrote:
Too many words? OK, here's the short version
of why phising occurs:
Browsers implement SSL+PKI and SSL+PKI is
secure so we don't need to worry about it.
PKI+SSL *is* the root cause of the problem. It's
just not the certificate level but the business and
| Jerrold Leichter wrote:
| It's also clear that they don't expect customers to look closely at, or
| question, their bills. If they did, they'd make sure that meaningful
merchant
| names appeared on the bills, or at least were available if you called to ask
| about a charge.
|
| a company
On Fri, 22 Jul 2005, Jerrold Leichter wrote:
The banks, operating through the clearing agents, could if they wished
impose a requirement on the way names appear in billing statements,
regardless of how the names appear on contracts. Alternatively,
they could at least require that an
Jerrold Leichter wrote:
If this is all you need, then using a 1-way hash of the card number for
identification and the card number itself for security would give you much
of what you need. There are databases out there which identify customers
by their CC numbers, not because they are willing
| one of the business processes is that somebody calls their issuing
| bank and disputes a charge by a specific merchant on such such a date.
| the issuing bank eventually provides notice to the merchant (giving the
| account number, date, and purchase details). the merchant then looks for
| a
Jeffrey I. Schiller wrote:
Btw. There are credit card issuers (ATT Universal is one) that permits
you to create a virtual one-time use credit card (with a time limit and
$$ limit if you want).
So when I shop at a merchant I don't want to trust, I open another
browser window and go to my
| an analogy i've used recently with respect to userid/password paradigm,
| is that account numbers are being concurrently used for both the userid
| function (requiring security *integrity* but not security
| *confidentiality*) as well as the password function (requiring strong
| security
John Kelsey [EMAIL PROTECTED] writes:
One nontrivial reason is that many organizations have spent a lot of time and
money building up elaborate rules for using PKI, after long negotiations
between legal and technical people, many hours of writing and revising,
gazillions of dollars in
James A. Donald [EMAIL PROTECTED] writes:
The PKI that was designed to serve no very useful function other than make
everyone in the world pay $100 a year to Verisign is dead.
Yet the technology is potent, and the problems of identity and authenticity
are severe. We shall, bye and bye, see
--
This is yet more reason why I propose that you
authorize transactions with public keys and not with
the use of identity information.
Dan Kaminsky [EMAIL PROTECTED]
It's 2005, PKI doesn't work, the horse is dead.
The PKI that was designed to serve no very useful
function other
On Thursday 14 July 2005 15:45, Aram Perez wrote:
RANT-PET_PEEVEWhy do cryptography folks equate PKI with
certificates and CAs?
Because it's the major example of what most would
agree is PKI, I'd guess. When we talked to people
in the certs and CAs world, they call it PKI. They
refer to
| Date: Wed, 13 Jul 2005 16:08:20 -0400
| From: John Denker [EMAIL PROTECTED]
| To: Perry E. Metzger [EMAIL PROTECTED]
| Cc: cryptography@metzdowd.com
| Subject: Re: ID theft -- so what?
| ...
| Scenario: I'm shopping online. Using browser window #1, I
| have found a merchant who sells what I
On Wednesday 13 July 2005 23:31, Dan Kaminsky wrote:
This is yet more reason why I propose that you authorize transactions
with public keys and not with the use of identity information. The
identity information is widely available and passes through too many
hands to be considered secret in
Ian Grigg [EMAIL PROTECTED] writes:
It's 2005, PKI doesn't work, the horse is dead.
He's not proposing PKI, but nymous accounts. The
account is the asset, the key is the owner;
Actually, I wasn't proposing that. I was just proposing that a private
key be the authenticator for payment card
Jörn Schmidt [EMAIL PROTECTED] writes:
The answer to this dilemma? I'm afraid this time it really is
legislation. Frankly, I'm not even sure if that would work but, at this
time, it's our best shot. Congress won't do anything about this unless
a few representatives have their identities
(Dan, in answer to your question on certs, below.)
On Thursday 14 July 2005 14:19, Perry E. Metzger wrote:
Ian Grigg [EMAIL PROTECTED] writes:
It's 2005, PKI doesn't work, the horse is dead.
He's not proposing PKI, but nymous accounts. The
account is the asset, the key is the owner;
RANT-PET_PEEVEWhy do cryptography folks equate PKI with
certificates and CAs? This fallacy is a major root cause of the
problem IHO. Why was the term PKI invented in the late 70s/early
80s (Kohnfelder's thesis?)?. Before the invention of asymmetric
cryptography, didn't those people who
From: Aram Perez [EMAIL PROTECTED]
Sent: Jul 14, 2005 10:45 AM
To: Cryptography cryptography@metzdowd.com
Subject: Re: ID theft -- so what?
RANT-PET_PEEVEWhy do cryptography folks equate PKI with
certificates and CAs?
One nontrivial reason is that many organizations have spent
a lot of time
Ian Grigg [EMAIL PROTECTED] writes:
This is not a new realization -- this goes back a long way.
OK, so maybe this part is the new realisation:
No, it isn't a new realization either, Ian. We all knew from nearly
the start that the model we were using in browsers was wrong. I don't
know anyone
--- John Denker [EMAIL PROTECTED] wrote:
[...]
It's only a problem if somebody uses that _identifying_
information to spoof the _authorization_ for some
transaction. [...]
Identifying information cannot be kept secret. There's
no point in trying to keep it secret. Getting a new
SSN
John Denker [EMAIL PROTECTED] writes:
My point here is that knowing who I am shouldn't be a
crime, nor should it contribute to enabling any crime.
Suppose you know who I am. Suppose you know my date of
birth, social security number, and great-great-grandmother's
maiden name. As Spike said,
Quoting Perry E. Metzger [EMAIL PROTECTED]:
So, rephrasing, the problem is not that secret information isn't a
fine way to establish trust -- it is the pretense that SSNs, your
mom's birth name or even credit card numbers can be kept secret.
Identifying information cannot be kept secret.
On Wed, Jul 13, 2005 at 12:15:48PM -0400, Perry E. Metzger wrote:
John Denker [EMAIL PROTECTED] writes:
My point here is that knowing who I am shouldn't be a
crime, nor should it contribute to enabling any crime.
Suppose you know who I am. Suppose you know my date of
birth, social security
On 07/13/05 12:15, Perry E. Metzger wrote:
However, I would like to make one small subtle point.
... the use of widely known pieces of information about
someone to identify them.
Yes, there are annoying terminology issues here.
In the _Handbook of Applied Cryptography_ (_HAC_)
-- on page
This is yet more reason why I propose that you authorize transactions
with public keys and not with the use of identity information. The
identity information is widely available and passes through too many
hands to be considered secret in any way, but a key on a token never
will pass through
Dan Kaminsky [EMAIL PROTECTED] writes:
This is yet more reason why I propose that you authorize transactions
with public keys and not with the use of identity information. The
identity information is widely available and passes through too many
hands to be considered secret in any way, but a key
I am reminded of a passage from Buffy the Vampire Slayer.
In the episode Lie to Me:
BILLY FORDHAM: I know who you are.
SPIKE: I know who I am, too. So what?
My point here is that knowing who I am shouldn't be a
crime, nor should it contribute to enabling any crime.
Suppose you
28 matches
Mail list logo
