[521] in cryptography@c2.net mail archive
Re: SSL weakness affecting links from pa
daemon@ATHENA.MIT.EDU (Bill Stewart)
Sat Apr 12 11:05:09 1997
Date: Fri, 11 Apr 1997 23:01:42 -0700
To: ARTURO GRAPA YSUNZA <AGRAPA@banamex.com>
From: Bill Stewart <stewarts@ix.netcom.com>
Cc: "Mark M." <markm@voicenet.com>,
"cypherpunks@toad.com" <cypherpunks@toad.com>,
"cryptography@c2.net" <cryptography@c2.net>
In-Reply-To: <c=MX%a=_%p=BANACCI%l=CENTRALES/BARRANCA24/00015C5B@mex3976
bcaop1.banamex.com>
At 01:54 AM 4/11/97 -0500, ARTURO GRAPA YSUNZA <agrapa@banamex.com> wrote:
>See http://www.Microsoft.com/security/
>under "Credit Card Security Concerns and Microsoft's Response"
>for Microsoft's response on the SSL GET/POST weakness. żAny opinions?
Thanks for the pointer to MS's security site; there's a lot of
good information there.
I was highly unimpressed with Microsoft's Response:
"It's Not A Security Flaw"
"But Everybody Important Works Around It"
"And we're fixing it in the next release"
without providing much detail about what's going on.
It does indicate what to look into to avoid it when writing web pages,
but it doesn't say how to avoid it when entering your credit card number
into a web page, or what to look for as a non-programmer user.
# Thanks; Bill
# Bill Stewart, +1-415-442-2215 stewarts@ix.netcom.com
# You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp
# (If this is a mailing list, please Cc: me on replies. Thanks.)
