<<< Date Index >>>     <<< Thread Index >>>

Re: New whitepaper "The Phishing Guide"



Agreed but forcing phishers to generate key pairs, purchase certificates, and/or buy-off CA vendor personnel creates additional audit trails that could help in the tracking and prosecution of those individuals. Combine this with certificate revocation and you have at least a model that gives more verification, auditing, and remediation than currently exists in the pursuit of these criminals. It's at least a step in the right direction and shouldn't be avoided simply because it won't immediately stop all phishing attacks or protect all users.

Watermarks do not stop all counterfeiting. Holograms do not stop all credit card fraud. It doesn't mean we shouldn't do what we can to help - even if its only a partial solution.

Chip Andrews
http://www.sqlsecurity.com

How does that help in practice? A user fooled by a link to ebay-support.com
is just as likely to accept signed mail from foo@xxxxxxxxxxxxxxxxx Not to
mention that the potential profits from phishing could easily finance the
purchase of a forged cert if someone at one of the built-in CA's was
corruptible. Given the several that are based in 3rd world companies (not to
mention recent US corporate scandals) I have no confidence that won't
eventually happen.

-Dan Veditz