4 ms·

IMHO, OpenPGP did it right. And there is an effort to use OpenPGP to authenticate hosts and users on the web. It already works for SSH: http://web.monkeysphere.

by mjgoins 17y ago

IMHO, OpenPGP did it right. And there is an effort to use OpenPGP to authenticate hosts and users on the web. It already works for SSH: http://web.monkeysphere.info http://web.monkeysphere.info

fexl 17y ago
That's a great concept which I need to try. The challenge will be extending it to SSL and making it friendly to Grandma. That said, when Grandma first signed up at building-and-loan.com, she probably went to the correct site. Now that she has trusted that site, she won't be fooled by phishing sites asking her to enter her building-and-loan.com password. Her browser will play a message from Wilford Brimley warning her about the new site. Of course when she first went to the building-and-loan.com site, she also got the warning from Wilford Brimley, which might have alarmed her. I suppose the warning would have to say "If you are signing up at this site for the first time, just make sure you came here by clicking a link that you trust." Grandma then thinks "well gee, I just clicked here from the Association for Golden Girls web site, so I should be fine."
- tptacek 17y ago
  You mean, until Grandma uses any other computer in the world, at which point she's either: * overtly exposed to attackers because no key has been remembered, or * at the mercy of whoever used the machine before her.
  - fexl 17y ago
    I welcome your suggestions on how browsers can help protect Grandma from the phishing on the computer she already uses. Using someone else's computer for secure access is always problematic, for reasons far deeper than we're discussing. I will think more on what happens when changing computers though. I don't think the "initial intercept" you're talking about is as dangerous as you suggest. If Grandma gets a brand new computer and types in "building-and-loan.com", she'll reach the correct site. She will trust it once on her new computer and forever after be invulnerable to phishing attacks for that site. That is the ongoing, routine, every day, incredibly expensive problem I want to see solved, not the relatively remote possibility that she'll type "building-and-loan.ru" on a brand spanking new computer.
- nfnaaron 17y ago
  "That said, when Grandma first signed up at building-and-loan.com, she probably went to the correct site." When I first followed this thread, I had this same thought. And it's true for this scenario. Maybe it's even true for most bank customers. But it does depend on that scenario, a user typing in the address on her own. What gave me doubt was an equally (more?) likely scenario, clicking on an affiliate link. People trust links, and most probably don't look at their status bar on hover.

by mjgoins 17y ago

IMHO, OpenPGP did it right. And there is an effort to use OpenPGP to authenticate hosts and users on the web. It already works for SSH: http://web.monkeysphere.info http://web.monkeysphere.info

fexl 17y ago

That's a great concept which I need to try. The challenge will be extending it to SSL and making it friendly to Grandma. That said, when Grandma first signed up at building-and-loan.com, she probably went to the correct site. Now that she has trusted that site, she won't be fooled by phishing sites asking her to enter her building-and-loan.com password. Her browser will play a message from Wilford Brimley warning her about the new site. Of course when she first went to the building-and-loan.com site, she also got the warning from Wilford Brimley, which might have alarmed her. I suppose the warning would have to say "If you are signing up at this site for the first time, just make sure you came here by clicking a link that you trust." Grandma then thinks "well gee, I just clicked here from the Association for Golden Girls web site, so I should be fine."

tptacek 17y ago
You mean, until Grandma uses any other computer in the world, at which point she's either: * overtly exposed to attackers because no key has been remembered, or * at the mercy of whoever used the machine before her.
- fexl 17y ago
  I welcome your suggestions on how browsers can help protect Grandma from the phishing on the computer she already uses. Using someone else's computer for secure access is always problematic, for reasons far deeper than we're discussing. I will think more on what happens when changing computers though. I don't think the "initial intercept" you're talking about is as dangerous as you suggest. If Grandma gets a brand new computer and types in "building-and-loan.com", she'll reach the correct site. She will trust it once on her new computer and forever after be invulnerable to phishing attacks for that site. That is the ongoing, routine, every day, incredibly expensive problem I want to see solved, not the relatively remote possibility that she'll type "building-and-loan.ru" on a brand spanking new computer.
nfnaaron 17y ago
"That said, when Grandma first signed up at building-and-loan.com, she probably went to the correct site." When I first followed this thread, I had this same thought. And it's true for this scenario. Maybe it's even true for most bank customers. But it does depend on that scenario, a user typing in the address on her own. What gave me doubt was an equally (more?) likely scenario, clicking on an affiliate link. People trust links, and most probably don't look at their status bar on hover.