Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security FullDisclosure
[Top] [All Lists]

[Full-Disclosure] Looking for some input

Subject: [Full-Disclosure] Looking for some input
Date: Thu, 27 May 2004 10:40:17 -0600
I posted this on the Dshield list a couple of days ago. Sorry to those of you 
who are seeing this again.

I'm looking for some input from the community at large on an issue that
has been bothering me for a while.

The institution where I do my banking has a login to an internet banking
page. While the login goes to an SSL enabled site, the login page is on
a non-SSL site. My question is: Doesn't this leave the members of the
institution open to phishing via DNS cache poisoning? Doesn't this
defeat the endpoint verification piece of an SSL certificate?

I'm looking for general input on this, so any replies are appreciated.

Thank you,
Shannon Johnston


<Prev in Thread] Current Thread [Next in Thread>