RE: how can you verify that the site you get is not a fake?

From: Joel Jaeggli (joelja_at_darkwing.uoregon.edu)
Date: 06/06/05

  • Next message: Michael Yep: "Re: / partition full root user also not able to write anything to disk" 
    Date: Mon, 6 Jun 2005 10:23:12 -0700 (PDT)
To: bedouglas@earthlink.net, For users of Fedora Core releases <fedora-list@redhat.com>

    On Mon, 6 Jun 2005, bruce wrote:

    > but you still haven't addressed my problem/issue/question...
    >
    > and that's how do i as a user (not an app) know that this is the right site
    > for the url i entered... my fear is that a malicious site, could simply fake
    > the information he's providing, to 'look' like the actual/real site...

    The point is the site cert is hard to fake... so look at that.

    No mechanism outside of cryptographic ones has any hope of demonstrating
    uniqueness in the context internet connectivty.

    joelja

    > and as of yet.. i can't craft a solution to this issue...
    >
    > -bruce
    >
    >
    > -----Original Message-----
    > From: fedora-list-bounces@redhat.com
    > [mailto:fedora-list-bounces@redhat.com]On Behalf Of Felipe Alfaro Solana
    > Sent: Monday, June 06, 2005 4:02 AM
    > To: For users of Fedora Core releases
    > Subject: Re: how can you verify that the site you get is not a fake?
    >
    >
    > On 6/6/05, Steffen Kluge <kluge@fujitsu.com.au> wrote:
    >> On Sun, 2005-06-05 at 21:42 -0700, bruce wrote:
    >>> as i understand the ssl process... the browser hits the ssl site.. the
    > site
    >>> returns some information to me, the browser. my question/statement, if i
    >>> know what the information shoudl be from the server with the ssl cert,
    > then
    >>> why couldn't i somply craft a response on my server, and send the
    >>> information back to the browser...
    >>
    >> The information sent to the client is the server's public key bearing
    >> some CA's signature (a.k.a. a certificate). The CA's signature vouches
    >> for the fact that the key pair to be used really belongs to you (the
    >> server). In order to play ball you don't just need the certificate (or
    >> public key - that's, err, public), you also have to have the matching
    >> private key. Assuming paypal keep their private keys secure, you can
    >> trust their SSL site, if you trust their CA.
    >
    > The X.509 certificate is a document signed by a trusted third-party
    > (in fact, not directly trusted by you, but by your browser or any
    > other SSL-enabled software), which asses the public key carried in
    > that certificate belongs to the subject to which the certificate is
    > expedited. The trusted third-party, called CA (Certificate Authority)
    > has to check that the subject (user for e-mail only certs, machine for
    > Web certs and so on) identity is valid and passes some validity
    > checks.
    >
    > When connecting via HTTP/S, the remote Web server must prove that it
    > also has/knows the private key associated with the certificate's
    > public key. Else, anyone could stole the certificate and present it to
    > remote clients without proving he/it is the only one authorized owner.
    >
    > SSL is far from perfect, as there are weak mechanisms on which it,
    > directly or indirectly, depends, like trust chains, name resolution,
    > hash and crypto algorithms and human intervention.
    >
    > --
    > fedora-list mailing list
    > fedora-list@redhat.com
    > To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
    >
    > 

    -- 
--------------------------------------------------------------------------
Joel Jaeggli  	       Unix Consulting 	       joelja@darkwing.uoregon.edu
GPG Key Fingerprint:     5C6E 0104 BAF0 40B0 5BD3 C38B F000 35AB B67F 56B2
-- 
fedora-list mailing list
fedora-list@redhat.com
To unsubscribe: http://www.redhat.com/mailman/listinfo/fedora-list
  • Next message: Michael Yep: "Re: / partition full root user also not able to write anything to disk"

    Relevant Pages

    • Re: CA Q
      ... I'm gonna start a new Root CA company. ... that I've done so far is issue a certificate to my IIS webserver. ... that possesses that the private key is reasonably the party that was issued the key and that the keys can used used for the attempted operation. ... This is where certification authorities come into play - they provide the trust structure. ...
      (microsoft.public.cert.exam.mcse)
    • Re: Proposal for a new PKI model (At least I hope its new)
      ... That is say I trust Paul Rubin's public key. ... two basic reasons for the SSL server domain name certificate: ... certificates have to check with the domain name infrastructure to see ... CA/PKI industry is that public keys be registered with the domain name ...
      (sci.crypt)
    • Re: How do I store secrets?
      ... One of the aspects of digital signature verification that is too often ... since encrypted with the PRIVATE key for which you have, and TRUST, ... If the certificate is issued by a KNOWN and TRUSTED CA, ... Then you create a server ...
      (microsoft.public.dotnet.security)
    • Re: New Method for Authenticated Public Key Exchange without Digital Certificates
      ... you are referring to any situation where there might be some trust ... resorting again to the merged security taxonomy and glossary ... as definitions specifically within the context of a Public Key, ... Certificate, Certification Authority environment. ...
      (sci.crypt)
    • Re: verisign security,lol
      ... "Igor Tandetnik" wrote: ... In order to provide this trust, ... > certificate, and keeps the company's vital stats on file. ... Dont believe average user cares what ca is used anyways. ...
      (microsoft.public.vc.atl)