3 ms·
> The only attack which still works is if they control DNS and can forge an SSL certificate Or if they're able to get some malware onto your system permitting
by oarsinsync 10y ago
> The only attack which still works is if they control DNS and can forge an SSL certificate
Or if they're able to get some malware onto your system permitting them to change your dns servers or alter your hosts file, and add certificates to your OS/browser trust store.
- acdha 10y agoBoth of those fall into “control of DNS” or “forging an SSL certificate”. Besides, if they can do either of those things they don't need to phish you because they can just hijaack your existing browser when you login to the real site.
- Kadin 10y agoSure, but that's raising the bar a hell of a lot higher than where it is currently, where all you need is a HTML email message that happens to superficially resemble something a random person might expect Google to send. And in the long run I have more faith in making systems more secure via technological means than to try and convince users not to click on links in shady email messages. So by moving the problem into the technology domain and out of the social domain, I'd say it's a big win.