[520] in cryptography@c2.net mail archive
Re: SSL weakness affecting links from pa
daemon@ATHENA.MIT.EDU (ARTURO GRAPA YSUNZA)
Fri Apr 11 19:33:15 1997
From: ARTURO GRAPA YSUNZA <AGRAPA@banamex.com>
To: Bill Stewart <stewarts@ix.netcom.com>, "Mark M." <markm@voicenet.com>
Cc: "cypherpunks@toad.com"
<cypherpunks@toad.com>,
"cryptography@c2.net" <cryptography@c2.net>
Date: Fri, 11 Apr 1997 01:54:00 -0500
See http://www.Microsoft.com/security/
under "Credit Card Security Concerns and Microsoft's Response"
for Microsoft's response on the SSL GET/POST weakness. =BFAny opinions?
Art Grapa
agrapa@banamex.com
----------
From: Mark M.
To: ARTURO GRAPA YSUNZA; Bill Stewart
Cc: cypherpunks@toad.com; cryptography@c2.net
Subject: Re: SSL weakness affecting links from pa
Date: Saturday, March 29, 1997 1:11AM
Microsoft Mail v3.0 IPM.Microsoft Mail.Note
De: Mark M.
Para: ARTURO GRAPA YSUNZA
Bill Stewart
Cc: cypherpunks@toad.com
cryptography@c2.net
Asunto: Re: SSL weakness affecting links from pa
Fecha: 1997-03-29 01:11
Prioridad: 3
Ident. del mensaje: 83A07AD005A0D011AF8C006097838CEB
-----------------------------------------------------------------------
----- --
-----BEGIN PGP SIGNED MESSAGE-----
On Fri, 28 Mar 1997, Bill Stewart wrote:
> http://www.zdnet.com:80/intweek/daily/970327x.html
> has an article about an SSL problem that affects both Netscape
> and MicrosoftIE browsers, leaking "secure" data such as
> credit card numbers from web pages with GET-based SSL forms on it.
> It was discovered by Dan Klein.
>
> There isn't specific detail about how the flaw works,
> but it says that it affects GET forms but not POST.
> Commentary from NS, MS, Gene Spafford, and Steve Bellovin.
>
> "It's like you've gone to the restaurant with your lover," Klein =
said.
> "The restaurant is there, it's private, yet when you leave the
restaurant
> you have the menu in your hand and there's food all over your =
shirt."
I would guess that this means that Netscape and Explorer send the
complete
URL of the page that linked to another site in the "HTTP-REFERER" header
in
the clear when SSL is used. The only temporary solution is to use a
local
web
proxy that removes this header, or, as the article suggests, manually
type
in
an URL that is linked from a page using SSL. I can't think of too many
situations where one might follow a link to another site immediately
after
sending sensitive information, but the contents of the "HTTP-REFERER"
header
are often logged, and the log is often world-readable...
>
>
>
> # Thanks; Bill
> # Bill Stewart, +1-415-442-2215 stewarts@ix.netcom.com
> # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp
> # (If this is a mailing list, please Cc: me on replies. Thanks.)
>
>
Mark
-----BEGIN PGP SIGNATURE-----
Version: 2.6.3
Charset: noconv
iQEVAwUBMzytJyzIPc7jvyFpAQE3gAf/frvfAWg44mEeg2AyhxlFKBmmh3yWEtmq
l8np9nTMz20/PHcF2uzDHrpSEcAY2WPcvEvu+57QGelU0H2LoH2qGFNeVisPQURE
9F5gUZvFeyubL9UVLlUoxVIMCumLM+y31zqVaMb8GwwGnHWNcHc1rqnUhchYamiJ
BbU04U3xaF5b5/mMBzKTU/tfTajeIDsAl0dhk0rzvXAMN2n26idoWic39ZzhHnsE
QOOfi4oI8XK4cMbjOKbwnSR7Xbt78800vilyp+mvkfgp/bR6ygougYzYz1s9dNY3
HgGpnuxDzFoHnqlIQ7in3N+QXXzSNh8TiVfU6w3PjoRk3RNZHX+DTQ=3D=3D
=3DQOto
-----END PGP SIGNATURE-----
