WebApp Sec mailing list archives

RE: (secure email) Proposal to anti-phishing


From: Michael Silk <michaelsilk () gmail com>
Date: Mon, 24 Jan 2005 15:24:12 +1100

Lyal said:
The difference is that client-side SSL exists today in an industry 
standard platform independent manner that could be effectively 
deployed. (management is a different issue that I will be a 
coward and 
ignore for now.)

It's hard to see how changing the locaiton of a password 
verification actually makes any difference to accountholder 
security or phishing.

Is it? Surely it's easy to see. Phishing requries the user to enter
the password in a website. If they don't need to do this (or only
enter partial password) because of certificate, then I think it's
pretty easy to see how that is an advantage.


And then there's the pragmatic fact that people will pay Microsoft 
protection-racket funds for Microsoft anti-spyware to protect 
themselves transparently in the background from the crappy software 
Microsoft *SOLD* them in the first place...and they will do 
this long 
before they'll use any of the "secure email"
solutions today that require user interaction & thought.

But I'm all for an global standard secure email solution if 
you happen 
to have one of those handy,

Actually, my company does - if anyone wants to buy it.

Global, is it? Who buys it then? How does it work? Care to share more
details, because there is not much information on your site. Doesn't
seem any different to what PGP would provide.

It's also rather interesting that you claim it "encrypts" everything,
but also analyses it for spam, viruses ... now just how does it do
that :) ?

And what is "content checked". Seems far to "big brother" for my liking.


Current thread: