Re: Looking for some input

[Valdis.Kletnieks () vt edu]

On Thu, 27 May 2004 10:40:17 MDT, Shannon Johnston <sjohnston () libertysite com>  said:

> The institution where I do my banking has a login to an internet banking
> page. While the login goes to an SSL enabled site, the login page is on
> a non-SSL site. My question is: Doesn't this leave the members of the
> institution open to phishing via DNS cache poisoning? Doesn't this
> defeat the endpoint verification piece of an SSL certificate?

Contemplate the real-world usefulness of an SSL cert.

No, seriously - consider Matt Blaze's comment that "A CA can protect you
against anybody they're not accepting money from" - then go read the chapter in
Schneier's "Secrets and Lies" about it.

Or as a faster check - how many people actually click on that little padlock,
read the "This site has correctly identified itself" blurb, and then go the
extra step of actually looking at the certificate to ensure it's not a spoofed
site that's correctly identified itself under the spoofed site name? (Hint -
would you notice if it said "The website www.g00gle.com has correctly
identified itself"?)  Oh - and do that for *every* encrypted page? ;)

If I can hijack your connection to your bank by poisoning your ISP's DNS cache,
I can do the exact same thing to hijack you to a typosquatter site that
correctly identifies itself as the typosquatter site....

Attachment: _bin
Description: