<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
James A. Donald wrote:<br>
<blockquote cite="mid453CAD7D.7000009@echeque.com" type="cite">
<pre wrap="">Sites that use SRP or HTTPS cannot be exploited in this
fashion.
If your bookmark says <a class="moz-txt-link-freetext" href="https://hushmail.com">https://hushmail.com</a>, and you
click on your bookmark, you will get to the right
hushmail.com, or fail to get anywhere.
</pre>
</blockquote>
Not entirely correct. The way OpenID works currently, it is possible to
spoof it, even if secured by SSL and DNSSEC. Therefore there is
something else missing as well...But with the correct controls in place
(at the IDP's and RP's), this will not happen anymore afterwards if
secured by SSL and DNSEC.<br>
<br>
Correct is, that only the real site will have a valid certificate,
which however neither the IDP nor RP is validating as of now...<br>
<br>
<div class="moz-signature">-- <br>
<div><font face="Arial" size="2">Regards</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">Signer: Eddy Nigg, StartCom Ltd.</font></div>
<div><font face="Arial" size="2">Phone: +1.213.341.0390</font></div>
</div>
</body>
</html>