Subject: [Gen-art] Re: draft-hartman-webauth-phishing Section 3.1

From: Christian Vogt <[email-masked]>
Date: Thu, 15 Nov 2007 17:22:45 +0200

Hi Eliot -

I think we are actually on the same page regarding section 3.1, and this
is just a terminology question.  What you consider "private" is the
personal data desired by the attacker, whereas I was considering this to
be the user's username and password.

>>    Mechanisms attackers use to accomplish this include links with a
>>    misleading name or URI, which they may distribute in emails;
>>    attacks against DNS; and man-in-the-middle attacks against a TLS
>>    handshake.  The former two attacks allow the attacker to pass
>>    authentication because the victim user can be tricked into
>>    accepting the attacker's certificate.  The latter attack will
>>    typically create a warning on the victim user's side, but many
>>    users cannot make informed decisions on how to respond to such a
>>    warning, making them inclined to accept the bogus certificate.
> 
> I do like this text, with the exception that I would replace "cannot
> make informed decisions" with "do not make informed decisions".  And
> indeed you have hit the nail on the head here IMHO.

Yes, that replacement makes sense.

Alright, take care,
- Christian

_______________________________________________
Gen-art mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/gen-art