Feets
Premium
join:2002-12-11
Hamilton, ON
 ·Cogeco Cable
| reply to B
Re: Banks Abandoning SSL On Home Page Log-Ins
said by B  : This confuses everybody who's waiting to see a padlock icon. Despite offering some peace of mind, the padlock icon is also the quickest way to verify the you are logging into actually came from the bank's server. |
|
nil
Java Geek
join:2000-11-27
1 edit | How is that.. bad guys can't use SSL? |
|
mers2
Premium,MVM
join:2004-03-20
USA
clubs:
 ·AT&T U-Verse
| said by nil :How is that.. bad guys can't use SSL? Which is why, especially with my financial institution, I want to know before I log on that SSL logon is working.
--
God put me on this Earth to accomplish a certain number of things. Right now, I am so far behind I will never die. |
|
Daniel
Premium,MVM
join:2000-06-26
Pleasanton, CA
clubs: 
1 edit | reply to Feets
Actually folks, there is another major issue here. How exactly are they supposed to verify the authenticity of a certificate? Are they supposed to do it after entering their credentials and sending them somewhere?
At that point it's more an informational thing. "Oh goody, let me just check and see real quick where I actually just sent my password."  Russia? Oh, that's not good.
The browser should balk at bad certs, but the point is that this is not the sort of thing you want to verify after clicking submit.
--
dmiessler.com - grep understanding knowledge |
|
nil
Java Geek
join:2000-11-27
Host:
Webmasters and Dev..
Forum Feature Requ..
| That's a fair point
I still say the real issue is the kind of information that is sent.. not how it's sent. All the security & keylogger issue could be made a lot less relevant with some brainstorming..
--
Life is too short to be boring |
|
B
Premium,MVM
join:2000-10-28
| I hope you're right, nil , but I can't help thinking that this has been considered for years in the business world and the best we seem to have come up with is smart card tokens with synchronized time-based hashes. They're annoying. Fingerprint scanners have been shown in most cases to have laughable security. I don't know that there's an answer. (Though MS seems to feel differently.) I'm not ready to give up on userids and passwords.
I talked about a too-common little cert issue at »Eddie Bauer A major retailer went almost THREE WEEKS with an expired cert. Nobody cared. They still sold out of the Classic Fit Jeans.
-- B
--
In a realm outside causality and function |
|
