<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Hi David and everybody else!<br>
<br>
Recordon, David wrote:
<blockquote
cite="mid7E7CA24460925C44AEB4F202BA7E45F302B566@MOU1WNEXMB14.vcorp.ad.vrsn.com"
type="cite">
<pre wrap="">Alaric,
Mind sharing the attack...at least privately?
</pre>
</blockquote>
Sorry for that....I wasn't sure, if my theory holds the water, so I
wanted to test it...<br>
<blockquote
cite="mid7E7CA24460925C44AEB4F202BA7E45F302B566@MOU1WNEXMB14.vcorp.ad.vrsn.com"
type="cite">
<pre wrap="">
If this involved DNS spoofing, then it certainly is known that OpenID
can be exploited in such fashion, just as every other site out on the
Internet today not using DNSSEC can be.
</pre>
</blockquote>
No David, I didn't use any DNS poisoning, but much simpler than that....<br>
<blockquote
cite="mid7E7CA24460925C44AEB4F202BA7E45F302B566@MOU1WNEXMB14.vcorp.ad.vrsn.com"
type="cite">
<pre wrap="">
I'm not sure exactly what you and Eddy are trying to prove. </pre>
</blockquote>
That with SSL secured homesites as a requirement, this would have been
harder. Obviously self-signed certificates wouldn't do the protection!
Since Dick already seems to agree to the extend, that if others agree
too, than at least the IDP's (homesites) shall be SSL secured as a
requirement, not recommendation....I think, that we've perhaps gained
something here....<br>
<blockquote
cite="mid7E7CA24460925C44AEB4F202BA7E45F302B566@MOU1WNEXMB14.vcorp.ad.vrsn.com"
type="cite">
<pre wrap="">I fully
understand that using OpenID with no SSL and no DNSSEC is technically
insecure, and no one has ever made the claim that OpenID has "military
grade" security as it stands today. Did you prove something else that
I'm just missing?
</pre>
</blockquote>
Well, SSL could give the first line of protection and yes, I'd like to
prove, how easy it would be to gain access to dick.myopenid.com or
whatever (I didn't do that, but used Alarics ID (startssl) instead).
Then perhaps everybody on this list is going to agree on this
requirement. <br>
<br>
I'm going to forward a few screen shots and more explanations to you
(Please mail me privately) if you are interested in it.<br>
<blockquote
cite="mid7E7CA24460925C44AEB4F202BA7E45F302B566@MOU1WNEXMB14.vcorp.ad.vrsn.com"
type="cite">
<pre wrap="">
Regards,
--David
</pre>
</blockquote>
<br>
<div class="moz-signature">-- <br>
<div><font face="Arial" size="2">Regards</font></div>
<div><font face="Arial" size="2"> </font></div>
<div><font face="Arial" size="2">Signer: Eddy Nigg, StartCom Ltd.</font></div>
<div><font face="Arial" size="2">Phone: +1.213.341.0390</font></div>
</div>
</body>
</html>