3 ms·
That reminds me: I'd like to purchase a SSL certificate for my domain please. The domain is gmail.com and to prove that it's mine, please send the confirmation
by pilif 17y ago
That reminds me: I'd like to purchase a SSL certificate for my domain please. The domain is gmail.com and to prove that it's mine, please send the confirmation to xxxx@gmail.com
Thanks in advance!
In the end though, most phishing attacks still use non-secured connections or they purchase one of these domain validation only certificates for evildomain.org and then use the usual tricks like paypal.com.evildomain.org or whatever.
This would even work with EV certificates, helping the phishers to gain that green address bar said to be unachievable for them.
SSL only proves identity. It can't say anything about malicious intents.
- mike-cardwell 17y agoThey tend to have a list of addresses that the certificate can be sent to, eg: postmaster@domain webmaster@domain ssladmin@domain If you can get access to ssladmin@gmail.com, then you can probably register an SSL cert for gmail.com.
- gus_massa 17y agoThe problem is that if each CA makes its own list, it is very difficult to make a secure web mail service and I hope that no Susan Sladmin is working at your organization. If I want to make a Mailinator clone, which address should I reserve? (For example webmaster@mailinator.com is working. http://www.mailinator.com/maildir.jsp?email=webmaster http://www.mailinator.com/maildir.jsp?email=webmaster)
- mike-cardwell 17y agoYes. There are hundreds of CA's and they all work differently. It's a security nightmare.