Hmm,
Well that seems far easier then, doesn't it :)
So all the user would need to do is install this certificate on their
computer and then they would login with a username and password as
normal.
To clarify one thing, however.
Would this leave the system open to a Man-In-The-Middle attack ? I'll
admit I'm not very familiar with using a private key to authenticate
formally but I assume it's something like:
1) Site generates random number, encrypts.
2) Site: please decryptthis number.
3) You: Okay, it's "135".
4) Site: Yes, that's what we sent you.
-- Authenticated --
Assuming it is this system (and even if it isn't the site will need
to be passed the information required to login somehow) couldn't the
site then relay the connection on to the real bank ?
If we used the email system you can't have this form of attack
because the bank provides you the correct link AND the correct
password; without the correct password the rest of the information you
could provide to the phisher is virtually useless.
-- Michael
On Sat, 27 Nov 2004 10:18:58 -0600, lists@dawes.za.net
<lists@dawes.za.net> wrote:
Quoting Michael Silk <michaelsilk@gmail.com>:
Hi Christopher,
Thanks for your feedback, let me address it.
First let me say that many people have raised
the issue (privately) of unecrypted emails not
being good enough - and they have a point. So
from now onwards let us assume that public
key/private key exchange system is used to
communicate the emails such that:
And if they are using a public key system, why would you bother with email
then?
Just make them use the private key to authenticate to the website. There is
STILL no opportunity for phishing, as the user never types in any details.
They
simply authenticate the SSL session using the cert, and there are no further
opportunities for information theft.
Sounds to me like you just want to use email in there somewhere! ;-)
Rogan
