Skip to Content.
Sympa Menu

ch-scene - Re: secu's new website

ch-scene AT lists.ibiblio.org

Subject: RTP-area local music and culture

List archive

Chronological Thread  
  • From: ron thigpen <ron AT fuzzsonic.com>
  • To: RTP-area local music and culture <ch-scene AT lists.ibiblio.org>
  • Subject: Re: secu's new website
  • Date: Wed, 13 Apr 2005 14:55:52 -0400

Chris Calloway wrote:
This is what most banks have been doing for awhile. It
reduces logins by one click/page serve.

well, it replaces one HTTPS page serve with an HTTP page serve.

and it does provide encryption for that exchange, but it does not provide another service of SSL: server authentication to the client. prior to submitting their credentials, the end user can't check that the cert belongs to the site owner to whom they think they are dealing with.

this can make it easier to pull off certain types of credential theft hacks. esp. in a setting like a cyber-cafe or wireless hotspot where you don't have the normal level of assurances in the integrity of DNS and/or hosts file.

it's not that it's totally unsafe, but it's not the best they could have done.

--rt




Archive powered by MHonArc 2.6.24.

Top of Page