[8089] in cryptography@c2.net mail archive
Re: Public Key Infrastructure: An Artifact...
daemon@ATHENA.MIT.EDU (Bram Cohen)
Sat Nov 18 17:28:11 2000
Date: Sat, 18 Nov 2000 13:59:09 -0800 (PST)
From: Bram Cohen <bram@gawth.com>
To: Ben Laurie <ben@algroup.co.uk>
Cc: Lynn.Wheeler@firstdata.com, cryptography@c2.net, cypherpunks@cyberpass.net,
dbs@philodox.com, dcsb@ai.mit.edu
In-Reply-To: <3A16F9C5.3CAD3E96@algroup.co.uk>
Message-ID: <Pine.LNX.4.21.0011181357080.23125-100000@ultra.gawth.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
On Sat, 18 Nov 2000, Ben Laurie wrote:
> Bram Cohen wrote:
> >
> > Unless that problem is fixed, man in the middle is hardly made more
> > difficult - for example, Mallory could break into some random machine on
> > the net and steal it's public key, then hijack local DNS and when someone
> > goes to amazon.com redirect them to amazon.hackeddomain.com, and then
> > proxy to amazon.com - now even SSL says the connection is safe.
>
> Yes, and Mallory can't read the data - so what was the point?
Yes he can - he's presenting the key for hackeddomain.com, which he stole,
so he's quite capable of reading requests sent for it.
-Bram Cohen
