Failure of PKI in messaging

[John Levine]

> >> Suppose we have a messaging service that, like Yahoo,
> >> is also a single signon service, ...
>
>  John Levine wrote:
> > Then you just change the attack model.

>My proposal closes off the major attack path, and leaves the trojan
>and virus attack path wide open.

It doesn't do anything about the obvious attack path of phishing
credentials from the users to stick bogus trusted entries into their
accounts.  My examples showed all sorts of benign looking situations
in which users provide their credentials to parties of unknown
identity or reliability.

R's,
John

---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com