[Cryptography] So please tell me. Why is my solution wrong?

Thu Feb 16 16:58:08 EST 2017

<html>
  <head>
    <meta content="text/html; charset=utf-8" http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">On 16-Feb-17 6:28 PM, Tom Mitchell
      wrote:<br>
    </div>
    <blockquote
cite="mid:CAAMy4UR3bZAFxMWFhwD=pk3KPXP93wALyoqpam9G4QoWA-emYA at mail.gmail.com"
      type="cite">
      <div dir="ltr">
        <div class="gmail_extra">
          <div class="gmail_quote"><br>
            <blockquote class="gmail_quote" style="margin:0 0 0
              .8ex;border-left:1px #ccc solid;padding-left:1ex">
              The solution in 1 sentence reads:<br>
              <br>
              Once you view the web browser as an actor in the
              cryptography protocol everything else is classic
              cryptography i.e. your browser must authenticate itself by
              presenting a shared secret. That's it!</blockquote>
            <div><br>
            </div>
            <div>The solution is not a general case solution.   It helps
              only in the special case of a hijacked web environment. <br>
              It does not catch the case of a transparent application
              that can intercept keystrokes or even a paste <br>
              from a previously filled mouse copy buffer.   <br>
              <br>
            </div>
          </div>
        </div>
      </div>
    </blockquote>
    <br>
    True. I'm focusing on phishing which tries to bypass TLS. If your
    computer has been hacked in any way, virus etc. this solution won't
    save you.<br>
    <br>
    <br>
    <blockquote
cite="mid:CAAMy4UR3bZAFxMWFhwD=pk3KPXP93wALyoqpam9G4QoWA-emYA at mail.gmail.com"
      type="cite">
      <div dir="ltr">
        <div class="gmail_extra">
          <div class="gmail_quote">
            <div>Transparent applications must ........ a sense of
              security.<br>
            </div>
          </div>
        </div>
      </div>
    </blockquote>
    <br>
    Agreed.<br>
    <br>
    <blockquote
cite="mid:CAAMy4UR3bZAFxMWFhwD=pk3KPXP93wALyoqpam9G4QoWA-emYA at mail.gmail.com"
      type="cite">
      <div dir="ltr">
        <div class="gmail_extra">
          <div class="gmail_quote">
            <div><br>
              It still has value but is not sufficient.  If local
              javascript can see the local image then<br>
              it can be stolen or used in place.<br>
              <br>
            </div>
          </div>
        </div>
      </div>
    </blockquote>
    <br>
    True. In fact the image was chosen as a good example of a 'web
    browser' - 'user' shared secret. The idea of javascript grabbing the
    image totally undermines the idea. So my preference is that it be
    built into browsers. That the developers understand what's
    happening.<br>
    <br>
    <br>
    **********<br>
    <br>
    An addition to the one line description:<br>
    <br>
    One line:  Once you view the web browser as an actor in the
    cryptography protocol everything else is classic cryptography i.e.
    your browser must authenticate itself by presenting a shared secret.<br>
    <br>
    Browsers have two personalities. (A) installed software which can
    access the hard disk and (B) the browser canvas area which is
    controlled by a remote website. This personality cannot access the
    hard disk.<br>
    <br>
    TLS is implemented by personality (A). Without authentication you
    don't know which personality you are talking to. When Mallory
    utilises personality (B) to counterfeit a website (and/or browser
    interface) that's a phishing attack. All that 'full screen
    counterfeiting' stuff indicates just how far personality (B) can go.
    Hence on start-up of TLS our browser must authenticate itself as
    personality (A). Personality (B) is not able to present the correct
    image in fig1.<br>
    <br>
    This goes to the heart of the research i.e. I sought game theory
    screening strategies to elicit the genuine identity present. TLS
    (personality (A)) can show the image. Mallory and personality (B)
    cannot.<br>
    <br>
    Thanks<br>
    Joseph<br>
    <br>
    <br>
    <br>
    <br>
    <br>
    <br>
    <br>
    <br>
    <br>
    <br>
    <br>
    <p><br>
    </p>
  </body>
</html>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.metzdowd.com/pipermail/cryptography/attachments/20170216/aa953f4f/attachment.html>