[77083] in cryptography@c2.net mail archive
Re: "Free WiFi" man-in-the-middle scam seen in the wild.
daemon@ATHENA.MIT.EDU (Matthias Bruestle)
Tue Jan 23 16:33:31 2007
X-Original-To: cryptography@metzdowd.com
X-Original-To: cryptography@metzdowd.com
Date: Tue, 23 Jan 2007 16:00:11 +0100
From: Matthias Bruestle <mbruestle@masktech.de>
To: cryptography@metzdowd.com
In-Reply-To: <87d555n7mp.fsf@snark.piermont.com>
Hi,
Perry E. Metzger wrote:
> For years, I've complained about banks, such as Chase, which let
> people type in the password to their bank account into a page that has
> been downloaded via http: instead of https:.
>
> The banks always say "oh, that's no problem, because the password is
> posted via https:", and I say "but that's only if the page comes from
> *you*, and it might come from a bad guy."
A German bank had the same problem. After some discussions without
positive results I wrote an article about SSL problems for a large
German IT magazine and described their situation. A short time after
they changed the login page to https.
Matthias
--
Matthias Bruestle, Managing Director
Phone +49 (0) 91 19 55 14 91, Fax +49 (0) 91 19 55 14 97
MaskTech GmbH, Nordostpark 16, 90411 Nuernberg, Germany
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo@metzdowd.com
