RE: how can you verify that the site you get is not a fake?
From: Joel Jaeggli (joelja_at_darkwing.uoregon.edu)
Date: 06/06/05
- Previous message: Steffen Kluge: "RE: how can you verify that the site you get is not a fake?"
- In reply to: bruce: "RE: how can you verify that the site you get is not a fake?"
- Next in thread: Kenneth Porter: "RE: how can you verify that the site you get is not a fake?"
- Reply: Kenneth Porter: "RE: how can you verify that the site you get is not a fake?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Date: Sun, 5 Jun 2005 22:06:55 -0700 (PDT) To: bruce <bedouglas@earthlink.net>
On Sun, 5 Jun 2005, bruce wrote:
> joel...
>
> as i understand the ssl process... the browser hits the ssl site.. the site
> returns some information to me, the browser. my question/statement, if i
> know what the information shoudl be from the server with the ssl cert, then
> why couldn't i somply craft a response on my server, and send the
> information back to the browser...
The part you missed is that your browser has a keyring full of ca's that
it trusts. The cert that you recieve from a website is signed with the
private key of a ca. one of the assertions of public key cryptography is
that it's hard to recover the private key (two very large primes) from the
public key (the product of the large primes) because factoring very large
prime numbers is computationaly infeasable (This is an assertion you
should check back on every couple years).
So in order to subvert this process (assuming I can't hack the crypto)I
need to do one of four things, insert a new ca into your keyring, get you
to accept a cert that isn't signed by a ca that you trust (this causes a
warning message in your broswer), steal the cert installed on the
webserver and use it in conjunction with some ip based trickery to
masquerede as the site in question, or subvert the process (generally some
kind of background check) by which a ca that you trust signs keys. The
later is the most likey.
> feel free to try to tell me where the hole is in my question...
>
> -bruce
>
>
> -----Original Message-----
> From: Joel Jaeggli [mailto:joelja@darkwing.uoregon.edu]
> Sent: Sunday, June 05, 2005 9:34 PM
> To: bedouglas@earthlink.net; For users of Fedora Core releases
> Subject: RE: how can you verify that the site you get is not a fake?
>
>
> On Sun, 5 Jun 2005, bruce wrote:
>
>> ssl certs don't allow you, the user to know if you're at the right site!!
>> unless it's not possible to fake the information returned by the server to
>> the client. i suspect that the information stream is easily faked...
>
> ssl cert's are an assertion that the ca (cetrifcate authority) is
> asserting that the site you connecting to is who they say they are. if you
> trust the ca (who's public key is in your keyring) then you trust the
> sites that they vouch for. forging the ca's signature is infeasable.
> subverting the ca's procedures for signing a cert are in some cases not.
>
>> my question.. how do you know that paypal.com.. ia actually paypal.com
>> (paypal), and not a carefuly crafted fake!
>
> because you trust verisign. (maybe you trust them)
>
>> -bruce
>>
>>
>>
>> -----Original Message-----
>> From: fedora-list-bounces@redhat.com
>> [mailto:fedora-list-bounces@redhat.com]On Behalf Of Matthew Miller
>> Sent: Sunday, June 05, 2005 3:15 PM
>> To: For users of Fedora Core releases
>> Subject: Re: how can you verify that the site you get is not a fake?
>>
>>
>> On Sun, Jun 05, 2005 at 01:37:19PM -0700, bruce wrote:
>>> if i go to a site, how can i verify that the site that's displayed is
>> really
>>> the 'correct' site. is there a way to actually 'get' the ip address, and
>>> then to determine if that ip address actually matches up to the 'owner'
> of
>>> the site i'm looking at....
>>> any thoughts/ideas/etc...
>>
>> There's really not an absolutely good way to do this. The best we've got
> is
>> SSL server certificates.
>>
>> --
>> Matthew Miller mattdm@mattdm.org <http://www.mattdm.org/>
>> Boston University Linux ------> <http://linux.bu.edu/>
>> Current office temperature: 80 degrees Fahrenheit.
>>
>> --
>> fedora-list mailing list
>> fedora-list@redhat.com
>> To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
>>
>>
>
> --
> --------------------------------------------------------------------------
> Joel Jaeggli Unix Consulting joelja@darkwing.uoregon.edu
> GPG Key Fingerprint: 5C6E 0104 BAF0 40B0 5BD3 C38B F000 35AB B67F 56B2
>
-- -------------------------------------------------------------------------- Joel Jaeggli Unix Consulting joelja@darkwing.uoregon.edu GPG Key Fingerprint: 5C6E 0104 BAF0 40B0 5BD3 C38B F000 35AB B67F 56B2 -- fedora-list mailing list fedora-list@redhat.com To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
- Previous message: Steffen Kluge: "RE: how can you verify that the site you get is not a fake?"
- In reply to: bruce: "RE: how can you verify that the site you get is not a fake?"
- Next in thread: Kenneth Porter: "RE: how can you verify that the site you get is not a fake?"
- Reply: Kenneth Porter: "RE: how can you verify that the site you get is not a fake?"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Relevant Pages
|
