[dix] Re: [Ietf-http-auth] Notes on Web authentication enhancements

["Robert Sayre" <sayrer at gmail.com>]

On 6/23/06, Mark Nottingham <mnot at yahoo-inc.com> wrote:
> On 2006/06/19, at 2:59 PM, Eric Rescorla wrote:
>
> > 1. Capture-Resistant Credentials (CRC)
>
> This is a bit confusing; to me (disclaimer -- I'm just a layman, not a
> security expert), phishing is based on confusing the user about the RP's
> identity, not reusing credentials from RP X with RP Y. Of course, if you
> enable Common User Credentials, phishing will be possible in this manner.

FWIW, I took this mean that the attacker is able to reuse your
credentials on the site being impersonated. For example, Basic+TLS
requests give up your plain text password to chase.com if you are
tricked into sending them to evil-chase.com.

--

Robert Sayre

_______________________________________________
dix mailing list
dix at ietf.org
https://www1.ietf.org/mailman/listinfo/dix





ot architectural ones. 
However, keep in mind that the answers you give have serious 
architectural implications.)

pr
--
Pete Resnick <http://www.qualcomm.com/~presnick/>
QUALCOMM Incorporated - Direct phone: (858)651-4478, Fax: (858)651-1102

_______________________________________________
dix mailing list
dix at ietf.org
https://www1.ietf.org/mailman/listinfo/dix