[36795] in bugtraq
Re: New whitepaper "The Phishing Guide"
daemon@ATHENA.MIT.EDU (Aleksandar Milivojevic)
Thu Sep 30 20:57:09 2004
Message-ID: <4158342F.1000203@pbl.ca>
Date: Mon, 27 Sep 2004 10:39:27 -0500
From: Aleksandar Milivojevic <amilivojevic@pbl.ca>
MIME-Version: 1.0
To: bugtraq@securityfocus.com
In-Reply-To: <20040923192139.GM12669@immunix.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Seth Arnold wrote:
> http://www.internetnews.com/dev-news/article.php/721571
>
> Even the best-known X.509 Certification Agency has made screwups
> regarding one of the best-known publicly traded corporations. How hard
> do you think it would be to get certificates for something that sounds
> plausibly like a bank? Credit card company?
I totally agree with what you (and others) wrote. Most of the current
registrars fall from the sky some time ago, telling us that they are
"trusted" entities (yeah right). Even without that incident you
mentioned, would you trust company whose bussiness practices include
hijacking of DNS name space (scandal with wildcard .com and .net
entries) or sending deceptive domain renewals via mail? Probably not.
My point was that currently corporations are not even attempting to use
the tools they have available. It is more important to them that
message is nicely HTML formated, than putting even basic security
precausins (such as signing with x509 certificate).
--
Aleksandar Milivojevic <amilivojevic@pbl.ca> Pollard Banknote Limited
Systems Administrator 1499 Buffalo Place
Tel: (204) 474-2323 ext 276 Winnipeg, MB R3T 1L7
