[114818] in cryptography@c2.net mail archive
Re: Dutch Transport Card Broken
daemon@ATHENA.MIT.EDU (Peter Gutmann)
Sat Feb 9 18:40:57 2008
From: pgut001@cs.auckland.ac.nz (Peter Gutmann)
To: pgut001@cs.auckland.ac.nz, smb@cs.columbia.edu
Cc: cryptography@metzdowd.com, jamesd@echeque.com, perry@piermont.com
In-Reply-To: <20080207054200.68c64502@yellowstone.machshav.com>
Date: Thu, 07 Feb 2008 20:44:23 +1300
"Steven M. Bellovin" <smb@cs.columbia.edu> writes:
>There's another issue: initial account setup. People will still need to rely
>on certificate-checking for that. It's a real problem at some hotspots,
>where Evil Twin attacks are easy and lots of casual users are signing up for
>the first time.
It really depends on the value of the account, for high-value ones I would
hope it's done out-of-band (so you can't just sign up for online banking by
going to a bank's purported web page and saying "Hi, I'm Bob, give me access
to my account"), and for low-value stuff like Facebook I'm not sure how much
effort your password is worth to an attacker when they can get a million
others from the same site. I agree that it's still a problem, but switching
to failsafe auth is a major attack surface reduction since now an attacker has
to be there at the initial signup rather than at any arbitrary time of their
choosing. It's turning an open channel into a time- and location-limited
channel.
Peter.
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo@metzdowd.com
