[105187] in Cypherpunks
Re: verisign digital id's for outlook
daemon@ATHENA.MIT.EDU (Peter Gutmann)
Sun Nov 8 06:12:06 1998
From: pgut001@cs.auckland.ac.nz (Peter Gutmann)
To: cypherpunks@cyberpass.net, jkthomson@bigfoot.com
Date: Sun, 8 Nov 1998 23:54:53 (NZDT)
Reply-To: pgut001@cs.auckland.ac.nz (Peter Gutmann)
>A quick question for all you security-savvy people. Our IT instructor has
>asked the class to sign up for verisigns' 60-day trial of a class 1 digital
>id.
>
>I also understand that a well (poorly?) written activeX applet can grab my
>key basically without my knowledge (to speak nothing of the other myriad
>holes in win98/95)
>
>My question is, where the hell is the private key kept on the users box?
>How is it protected against attack?
It's protected by Microsoft asserting that it's protected. There's also some
sort of attempt at encryption (easily broken, see
http://www.cs.auckland.ac.nz/~pgut001/breakms.txt), but in any case there are
enough security holes there that anything which manages to run on your system
(ActiveX, as you've mentioned) can grab your keys without a lot of trouble.
Peter.
