Re: International Domain Name [IDN] support in modern browsers allows attackers to spoof domain name URLs + SSL certs.

From: lyal.collins (lyal.collins_at_key2it.com.au)
Date: 02/16/05

  • Next message: TAC: "NetSec Security Advisory: Multiple Vulnerabilities Resulting From Use Of Apple OSX HFS+" 
    To: Sebastian <security-basics@helsinki.fi.eu.org>, "Thor (Hammer of God)" <thor@hammerofgod.com>, Vincent Archer <var@deny-all.com>, bugtraq@securityfocus.com, Scott Gifford <sgifford@suspectclass.com>, David Schwartz <davids@webmaster.com>
Date: Wed, 16 Feb 2005 12:37:19 +1000

    One difference occurs to me immediately.
    In the CC scheme, every legitmate participant (issuing, acquiring, cardholder,
    merchant et al) have knowingly agreed to a contract under a common structure.

    In CA/PKI land, you may be legally and contractually obligated and have
    certain rights defined (or restricted) as a 'relying party', despite having
    have no prior commercial or contractual agreement with any other entity in the
    PKI heirarchy, or even knowledge that these other entities exist.

    Being bound by commercial contracts without prior knowledge is a serious
    impediment in the 'trust' being discussed here, imho.

    Lyal

    > A quick (and very non-scientific) thought: Do you have trust in the
    > issuer of your CC?
    > Do you trust a shop that has "Your major CC accepted" posted on the door?
    > Do you trust someone that can't provide the means to verify that trust,
    > with or without the sign?
    > Do you, as an average tourist, even know how you could check it?
    >
    > I would think that the answer lies in one of those questions..
    >
    > -Sebastian
    >
    > Thor (Hammer of God) wrote:
    >
    > >>> Nonsense. The CA is asking for your trust and can only earn revenue
    > >>> based
    > >>> upon the number of people who trust it.
    > >>
    > >>
    > >> Wrong. The CA gains trust because it manages to get its certificate
    > >> included
    > >> with the default package for major browsers.
    > >>
    > >> It then has to persuade its customers (the server operators) to buy a
    > >> certificate. It does not have to persuade any user: trust is already
    > >> implied by the bundling.
    > >
    > >
    > > Of course the CA has to gain the trust of the users... There are many
    > > uses for client-based certificates: code signing, user verification,
    > > email encryption, automatic mapping of user account to personal
    > > certificates, blah blah blah. The business model of commercial CA's
    > > is most certainly not limited to server operators only. While
    > > personal certificate stores come with pre-trusted root certificates
    > > from many CA's to automatically trust many server-based functions,
    > > there is a vast market for client certs.
    > >
    > > T
    >
    > --
    > No virus found in this outgoing message.
    > Checked by AVG Anti-Virus.
    > Version: 7.0.300 / Virus Database: 265.8.8 - Release Date: 14/02/2005 

    --
  • Next message: TAC: "NetSec Security Advisory: Multiple Vulnerabilities Resulting From Use Of Apple OSX HFS+"

    Relevant Pages

    • Re: wurld-scam sux
      ... not blah blah blah -- this is the whole point. ... A contract is a specific agreement on what will be done ... Commodore clones today instead of PC clones. ... real things like food and shelter are what's important. ...
      (comp.sys.cbm)
    • Re: Roller Marks in new asphalt driveway
      ... then you have to hire a lawyer and start sending nastygrams. ... I expect you signed a paving contract with *no* specifications for the ... "workmanlike" blah blah blah. ...
      (alt.home.repair)
    • Re: Insurance question for small business owners
      ... we have to have our insurance before we can get a license. ... > also have to pass a background check and 2 different written tests. ... >> Do we work with hazardous materials..blah blah blah. ... >>> They ask if you supply any services without a written contract. ...
      (alt.security.alarms)
    • Re: Looking for a program to run on XP to remotely watch what my kids are doing, something like a ke
      ... Bringing up Hobbes in a discussion of trust versus coercion is using ... > that the computers work for the company. ... > Jim Watt ... Your wife is bound to you by contract: ...
      (alt.computer.security)
    • Re: obfuscating the code?
      ... I understand that walking away from a contract is not ... You could set up a contrcat where they need to pay extra ... But trust can be 'betrayed' (for ... You are the party that wants to obfusticate the code. ...
      (comp.lang.php)