123 reputation
2
bio website
location
age
visits member for 1 year, 3 months
seen Feb 27 '13 at 9:50
I work as a software engineer in the financial services industry.

Feb
27
awarded  Scholar
Feb
27
comment Can SSL requests be proxied by issuing a second certificate?
I still don't really understand what it is that you're proposing. But in any case, if this is not intuitive to the user, then it doesn't work as prevention because I'm assuming here that my user is relatively non-computer-literate, otherwise they would have been savvy enough to check the address is correct in the address bar.
Feb
27
accepted Can SSL requests be proxied by issuing a second certificate?
Feb
22
comment Can SSL requests be proxied by issuing a second certificate?
Thanks for your detailed response and I think you one of the only users here who understood my original question!! I don't understand how this keygen method would work though? Surely it only affects the trust relationship between the real website and whatever system is accessing it (in this case it's the malicious website). I have not come across this keygen before, but it may be similar to a "CSRF Token" method we currently use where the user has to provide a unique token in the request, that we provided them with in the first place. Unfortunately, the attacker will also have it in this case.
Feb
22
comment Can SSL requests be proxied by issuing a second certificate?
I can trust the certificate authority as it relates to my interactions with them, but I can't trust them as it relates to a completely different certificate, site, and system!! What you are effectively saying is that Alice's trust in them should extend to the fact that they should never issue certificates on behalf of malicious websites. However there is no obvious automated way of knowing that the website is malicious - from a technical standpoint it looks fine, and only when a human manually investigates it would they see that it (Charlie's Bank) is trying to imitate Bob's Bank.
Jan
25
comment Can SSL requests be proxied by issuing a second certificate?
To be honest, I'm interested as to how to prevent this myself as a security architect, not as a user!! It sounds like you are saying the attack is completely possible and there is no real way to prevent it for someone who doesn't know how to protect themselves online.
Jan
25
comment Can SSL requests be proxied by issuing a second certificate?
@owlstead beat me to it by 1 minute!!
Jan
25
comment Can SSL requests be proxied by issuing a second certificate?
But how does the browser know it expects to see www.thebank.com? If the user clicked on a malicious link then the browser address bar will contain the malicious URL and the browser has no way of knowing this is not a legitimate action, right? Of course, all savvy people will check the address bar to see what site they are connecting to, but I am thinking of the majority of people who don't do that and are caught out in these kinds of attacks, and if there is any way to prevent it.
Jan
25
awarded  Student
Jan
25
asked Can SSL requests be proxied by issuing a second certificate?