Subject: Re: Software for PKI

From: [email-masked] (Peter Gutmann)
Date: Thu, 8 Nov 2001 12:42:56 +1300 (NZDT)

Eric Rescorla <[email-masked]> writes:
>[email-masked] (Peter Gutmann) writes:
>>There is a difference between transparent and oblivious.  SSL is most
>>definitely the latter, all you need to do is make sure you buy your cert from a
>>CA which won't produce a warning dialog when the browser connects and you're
>>set.  Because of this, SSL certs offer about the same security as
>>unauthenticted DH (without the PFS benefits).  It is very transparent though.
>This isn't QUITE true. Most clients check the URL against the hostname in the
>certificate. Ostensibly the CAs check that you're entitled to a certificate
>with said hostname before issuing.

That's trivially (and routinely) defeated by the stuff which ietf-tls is
currently arguing about though.  My favourite example: Go to www.united.com and
have a look at the cert you get.

Peter.

---

From: Eric Rescorla <[email-masked]>
Date: 07 Nov 2001 15:56:17 -0800

[email-masked] (Peter Gutmann) writes:
> currently arguing about though. 
I'm on ietf-tls and I don't see things quite that way...

> My favourite example: Go to www.united.com and
I can't seem to connect to www.united.com:443

I assume your point here is that it www.united.com redirects
you to www.ual.com? If so, I don't see the problem with this.
Noone ever said that SSL would protect you if someone tampered
with the URL you were dereferencing.

-Ekr

-- 
[Eric Rescorla                                   [email-masked]]
                http://www.rtfm.com/

---

From: Aram Perez <[email-masked]>
Date: Wed, 07 Nov 2001 23:15:29 -0800

On Wednesday, November 7, 2001, at 03:42  PM, Peter Gutmann wrote:

> [snip]
Supposedly this is one of the 10 Risks of PKI 
(http://www.counterpane.com/pki-risks-ft.txt). As I stated in a response 
I sent to Bruce S. and Carl E. 
(http://home.pacbell.net/aram/ResponseTenRisks.html), I don't stop 
trusting Bank Of America because they didn't really issue me my credit 
card (it was probably FirstData). By the same token, I won't stop flying 
United because they don't build the airplanes.

Whenever I'm using a Web site that needs any sensitive information from 
me, if SSL is not being used, then I won't provide the information.

Regards,
Aram Perez