<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Ryan Barrett wrote:
<blockquote
cite="midPine.LNX.4.64.0610201804570.19625@heaven.corp.google.com"
type="cite">
<pre wrap="">On Fri, 20 Oct 2006, Gabe Wachob wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Visa's 3-D Secure (known as Verified by Visa) does NOT trust DNS. In fact,
</pre>
</blockquote>
<pre wrap=""><!---->
fair enough. for closed systems, which it sounds like 3-D Secure is, that's
definitely a luxury that may make sense. however...
</pre>
<blockquote type="cite">
<pre wrap="">As a recent former employee of Visa, I can tell you that DNS is absolutely
*not* trusted for conducting value transactions on the net. At the very
least, SSL is the basis upon which any transaction data is trusted.
</pre>
</blockquote>
<pre wrap=""><!---->
i don't understand. DNS and SSL solve fundamentally different problems. DNS
resolves domain names to IP addresses; SSL encrypts TCP network connections.
</pre>
</blockquote>
<br>
SSL encrypts data, but its weakness is, that you can validate that the
name in the certificate matches the name of the site you are at, NOT
that you are at the right site.<br>
<br>
You see, if someone poisons your DNS, then you end up at the wrong
site, and with a carefully planned attack, a bad-guy could create a CA
that calls itself Verisign. Now, even if the user gets an error from
their browser, they will think its no big deal as most users don't know
how to validate certs themselves. Making this problem worse is the
"click until the boxes get out of my way" mentality users have adopted,
they don't read the message boxes. Topping this off is self-signed
certs setting off these messages like those from
<a class="moz-txt-link-freetext" href="https://www.biglumber.com">https://www.biglumber.com</a> or the fact that MS hasn't bothered to get
their new root certs in other browsers. <br>
<br>
SSL relies on DNS to validate the identity of the site. Thus DNS
solves a different problem, but it is intimately connected to SSL. The
only way to KNOW that the DNS hasn't been modified, is to use DNSSEC.<br>
<br>
<a class="moz-txt-link-freetext" href="http://startssl.wordpress.com/2006/09/16/ssl-dns-poisoningpharming-phishing-and-dnssec/">http://startssl.wordpress.com/2006/09/16/ssl-dns-poisoningpharming-phishing-and-dnssec/</a><br>
</body>
</html>