Re: [websec] Authentic inter-domain relationships. Is this a security problem? Appropriate for websec?

Chris Hartmann <> Wed, 14 January 2015 21:34 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 98D181AC3EF for <>; Wed, 14 Jan 2015 13:34:57 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id kKgJ5GsprPOr for <>; Wed, 14 Jan 2015 13:34:56 -0800 (PST)
Received: from ( [IPv6:2607:f8b0:4003:c06::236]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id CC0431A90CC for <>; Wed, 14 Jan 2015 13:34:55 -0800 (PST)
Received: by with SMTP id u20so9404588oif.13 for <>; Wed, 14 Jan 2015 13:34:55 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=XQcClvFxvd6jlqX7ytSjbR6KNxO6QQnk36+B5/wsJnE=; b=VMW0ORMF9YDsVfn/PjvbEn/hb6c2feDA9Uy6gROh38z2lc4ka3FDhpC/N/BkfwHaPs WhPUIlxmZqHUMCFKjdaVuKVBGyG/burb9kKgD36TMb2jWdmoKwpeCI1n8Yt8EtIDf1Cy Jl00kN9xScs7ZzdaRWe7QRwR1LTEd97cMpx+GNK0/J/xhuZLkFE940UoS6ongq7vrAIK 3sP58ProCjWoyDV7ENLeqkmBcXfh+iVG4cIeqldLnCmVf64rjbJMNfHpgPSryjftrg6n ssKmaf/dlPYkOPqkaNZJboDtSDc+4QcADWUE20uPPolGQ0sOkPiGx6/ax9657uTY4Ct3 Chhg==
MIME-Version: 1.0
X-Received: by with SMTP id mq2mr3929165oeb.50.1421271295087; Wed, 14 Jan 2015 13:34:55 -0800 (PST)
Received: by with HTTP; Wed, 14 Jan 2015 13:34:55 -0800 (PST)
In-Reply-To: <>
References: <> <> <> <>
Date: Wed, 14 Jan 2015 13:34:55 -0800
Message-ID: <>
From: Chris Hartmann <>
To: Anne van Kesteren <>
Content-Type: text/plain; charset=UTF-8
Archived-At: <>
Cc: websec <>
Subject: Re: [websec] Authentic inter-domain relationships. Is this a security problem? Appropriate for websec?
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Web Application Security Minus Authentication and Transport <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 14 Jan 2015 21:34:57 -0000

On Wed, Jan 14, 2015 at 1:15 AM, Anne van Kesteren <>; wrote:
> On Tue, Jan 13, 2015 at 9:30 PM, Chris Hartmann <>; wrote:
>> If a phisher
>> sent you an email claiming to be with a link to a fake but
>> believable hostname, say (see what I did there), you happen
>> to click the link and are on the verge of providing your credentials,
> Yeah, that's the concern.
>> When formed the business relationship with
>> it could perhaps share a bit of digitally signed data, say
>> digitally sign the url to the login page (
>> and embed that in response.
> Given that the current address bar UI already has limited utility,
> it's not clear to me what making it more complicated will actually
> help users.

Yeah, I also have the sense any proposed UA/UI change is going to be
highly scrutinized and be a point of resistance. But I have yet to
conclude how social engineering attacks can be comprehensively
addressed without at least partially arming end users with something
to help them make these important correlations. Trust by affiliation
is a real thing that we do in the real world, although these
affiliations are hard to verify, they work in general. In the digital
world fortunately we can have machines verify these affiliations with
an extremely high level of certainty, I'd argue people should be able
to perceive these to formulate trust.

> --