Re: How do we get the whole world to upgrade to DNSSEC capable resolvers?

[Ted Lemon <[e-mail]>]

Eric, one other thing to bear in mind with banks is that the typical  
user goes to http://www.bank.com and types in their password in the  
login form presented to them.   All I (the attacker) have to do to get  
their password is to arrange for the form with which they are  
presented to submit the password to an http:// URL instead of the  
bank's HTTPS:// URL.   SSL doesn't happen, so the user is not told  
about the invalid cert.   And chances are they've disabled the  
"insecure form" warning, because it pops up too often in cases where  
it doesn't matter.

The attacker can then tunnel the rest of the session, presenting the  
user with the illusion that they have in fact completed a transaction  
with the bank, leaving them no wiser to the fact that their login  
information has been compromised.

This will work even if the bank has a policy of presenting password  
forms only on SSL pages, because the average user won't know this, and  
thus won't be suspicious if they are offered a login on a non-https://  
page.

So the dance that's involved in phishing the user is really a lot  
simpler than you think, and the value of subverting the DNS is thus a  
lot higher.


--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>