Re: How do we get the whole world to upgrade to DNSSEC capable resolvers?

[Paul Vixie <[e-mail]>]

> Or even Kaminsky-subverting http://www.bank.com/ to point to a host
> which produces a redirect to https://www.bankfoo.com/, which is under
> the attacker's full control.

no real reason to s/bank/bankfoo/ in that example.  once you've got the A RR
for www.bank.com you can just not redirect folks to https:.  (their bookmark
is likely to be for the http: site, as will their search engine exit.)  or if
the attacker wants to get CRAZY they can redirect to https: quite safely since
the majority of endusers will just click "OK" on the resulting X.509 warning,
without reading it or understanding it.

kaminsky's plan to get a key issued by polluting the caching server of a CA so
that one can successfully emulate the desired common-name attribute is harder
work than needs doing, and so, i predict the criminals will take an easier way.

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.


--
to unsubscribe send a message to [e-mail] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>