RE: how can you verify that the site you get is not a fake?

From: bruce (bedouglas_at_earthlink.net)
Date: 06/06/05

  • Next message: Matthew Miller: "Re: how can you verify that the site you get is not a fake?" 
    To: "'Felipe Alfaro Solana'" <felipe.alfaro@gmail.com>, "'For users of Fedora Core releases'" <fedora-list@redhat.com>
Date: Mon, 6 Jun 2005 06:05:58 -0700

    but you still haven't addressed my problem/issue/question...

    and that's how do i as a user (not an app) know that this is the right site
    for the url i entered... my fear is that a malicious site, could simply fake
    the information he's providing, to 'look' like the actual/real site...

    and as of yet.. i can't craft a solution to this issue...

    -bruce

    -----Original Message-----
    From: fedora-list-bounces@redhat.com
    [mailto:fedora-list-bounces@redhat.com]On Behalf Of Felipe Alfaro Solana
    Sent: Monday, June 06, 2005 4:02 AM
    To: For users of Fedora Core releases
    Subject: Re: how can you verify that the site you get is not a fake?

    On 6/6/05, Steffen Kluge <kluge@fujitsu.com.au> wrote:
    > On Sun, 2005-06-05 at 21:42 -0700, bruce wrote:
    > > as i understand the ssl process... the browser hits the ssl site.. the
    site
    > > returns some information to me, the browser. my question/statement, if i
    > > know what the information shoudl be from the server with the ssl cert,
    then
    > > why couldn't i somply craft a response on my server, and send the
    > > information back to the browser...
    >
    > The information sent to the client is the server's public key bearing
    > some CA's signature (a.k.a. a certificate). The CA's signature vouches
    > for the fact that the key pair to be used really belongs to you (the
    > server). In order to play ball you don't just need the certificate (or
    > public key - that's, err, public), you also have to have the matching
    > private key. Assuming paypal keep their private keys secure, you can
    > trust their SSL site, if you trust their CA.

    The X.509 certificate is a document signed by a trusted third-party
    (in fact, not directly trusted by you, but by your browser or any
    other SSL-enabled software), which asses the public key carried in
    that certificate belongs to the subject to which the certificate is
    expedited. The trusted third-party, called CA (Certificate Authority)
    has to check that the subject (user for e-mail only certs, machine for
    Web certs and so on) identity is valid and passes some validity
    checks.

    When connecting via HTTP/S, the remote Web server must prove that it
    also has/knows the private key associated with the certificate's
    public key. Else, anyone could stole the certificate and present it to
    remote clients without proving he/it is the only one authorized owner.

    SSL is far from perfect, as there are weak mechanisms on which it,
    directly or indirectly, depends, like trust chains, name resolution,
    hash and crypto algorithms and human intervention. 

    --
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
  • Next message: Matthew Miller: "Re: how can you verify that the site you get is not a fake?"

    Relevant Pages

    • Re: X.509 and ssh
      ... certificate issued by a trusted party can access the server. ... When you extend their reach out to all these other forms of communication, and used by computer laymen, old-fashioned random public key strings is simply not at all feasibile. ...
      (comp.security.ssh)
    • Re: TLS-certificates and interoperability-issues sendmail / Exchange / postfix ..
      ... > to assert that certificate validation doesn't happen, ... this trusted public key store contains public keys of that the ... signed by the CA. this digital certificate is returned to the "key ...
      (comp.security.unix)
    • Re: how can you verify that the site you get is not a fake?
      ... >> know what the information shoudl be from the server with the ssl cert, ... > The information sent to the client is the server's public key bearing ... In order to play ball you don't just need the certificate (or ... Web certs and so on) identity is valid and passes some validity ...
      (Fedora)
    • Encrypting off-site with certificates public key
      ... I thought it would be wise to use a certificate encryption scheme to allow ... Then the data is written into a varbinarycolumn on the central server ... For some reason the public key is generating a different algorithm on .NET ...
      (microsoft.public.sqlserver.security)
    • Re: Is this right? Question about SSL and PKI...
      ... > issuing CLIENT certificates. ... > certificate on my server. ... can be authenticated with some public key in their table of trusted ...
      (sci.crypt)