<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.5pt;
font-family:Consolas;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:Consolas;}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoPlainText style='margin-left:.5in'>"Fraud monitoring is on<o:p></o:p></p>
<p class=MsoPlainText style='margin-left:.5in'> <o:p></o:p></p>
<p class=MsoPlainText style='margin-left:.5in'>Phishing Protection has scanned
this Web page and determined that it does not use an encrypted transmission protocol,
does not contain a password form field, and there is no indication of fraud."<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>This comes from my Symantec ToolBar, and it is even
visualized as a giant green bar, just under the (https) Address field<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>Is it valid? I've no idea what techniques they use, to
justify the representation that “there is no indication of fraud."
This may involve cert management (key distribution) technique and DNS authority
spoofing countermeasures, for all I know.<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>-----Original Message-----<br>
From: general-bounces@openid.net [mailto:general-bounces@openid.net] On Behalf
Of Chris Drake<br>
Sent: Thursday, June 14, 2007 10:52 AM<br>
To: Pat Patterson<br>
Cc: openid-general<br>
Subject: Re: [OpenID] Using HTTPS Openid Providers<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>Hi Pat,<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>Since the subject's in the open, and I'm busy enjoying
the scrutiny of<o:p></o:p></p>
<p class=MsoPlainText>verification for my EV SSL Cert - it's worth mentioning
that the<o:p></o:p></p>
<p class=MsoPlainText>rigorness of the "Extended Verification" together
with the IE7 native<o:p></o:p></p>
<p class=MsoPlainText>support for EV extensions puts a serious dent into MitM
problems.<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>If someone can pervert DNS, they can go get a free
3-month IPSCA (or<o:p></o:p></p>
<p class=MsoPlainText>paid geotrust) SSL cert, and silently impersonate the
victim web site,<o:p></o:p></p>
<p class=MsoPlainText>including the SSL chain.<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>While they might be able to buy a $1600 EV SSL Cert,
they'd have to<o:p></o:p></p>
<p class=MsoPlainText>pervert DNS, somehow get authority over domain ownership,
and accept a<o:p></o:p></p>
<p class=MsoPlainText>visit from a registered lawyer at their street address
(and convince<o:p></o:p></p>
<p class=MsoPlainText>him they're whatever company they're trying to pervert),
have a year<o:p></o:p></p>
<p class=MsoPlainText>of more of trading history, a working landline,
verifiable evidence of<o:p></o:p></p>
<p class=MsoPlainText>company registration (to their street address, using
their landline),<o:p></o:p></p>
<p class=MsoPlainText>and convince the EV examiner that they're 100% legitimate
before<o:p></o:p></p>
<p class=MsoPlainText>they'd *get* their signed $1600 cert. Quite a huge
difference...<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>Kind Regards,<o:p></o:p></p>
<p class=MsoPlainText>Chris Drake<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>Friday, June 15, 2007, 3:39:53 AM, you wrote:<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>PP> Hi Immad,<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>PP> I would say yes, https does make it significantly
harder to<o:p></o:p></p>
<p class=MsoPlainText>PP> do man inthe middle. In the absence of SSL, OpenID
with DH is<o:p></o:p></p>
<p class=MsoPlainText>PP> vulnerable to DNSattacks. HTTPS assuming, as Peter
mentioned,<o:p></o:p></p>
<p class=MsoPlainText>PP> decent ciphersuites andcareful cert management,
and full https<o:p></o:p></p>
<p class=MsoPlainText>PP> compliance, makes itsignificantly more difficult
for an attacker<o:p></o:p></p>
<p class=MsoPlainText>PP> to impersonate an OP.<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>PP> Cheers,<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>PP> Pat<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>PP> Immad Akhund wrote:<o:p></o:p></p>
<p class=MsoPlainText>PP> thanks for the quick advice.<o:p></o:p></p>
<p class=MsoPlainText> <o:p></o:p></p>
<p class=MsoPlainText>PP> Given that diffie hellman isconducted with the
openid<o:p></o:p></p>
<p class=MsoPlainText>PP> provider is there actually any additionalsecurity
benefit with<o:p></o:p></p>
<p class=MsoPlainText>PP> using https to communicate with the
openidprovider? Does it make<o:p></o:p></p>
<p class=MsoPlainText>PP> it significantly harder to do man in the
middleattacks (if thats<o:p></o:p></p>
<p class=MsoPlainText>PP> its purpose)? <o:p></o:p></p>
<p class=MsoPlainText> <o:p></o:p></p>
<p class=MsoPlainText>PP> I hadn't considered that the identity could be
under https<o:p></o:p></p>
<p class=MsoPlainText>PP> butthe server not and vice-versa. Where would you
see as the<o:p></o:p></p>
<p class=MsoPlainText>PP> biggestsecurity benefit to use https?<o:p></o:p></p>
<p class=MsoPlainText> <o:p></o:p></p>
<p class=MsoPlainText> <o:p></o:p></p>
<p class=MsoPlainText>PP> Sxipper also uses SSL, both for the OP-endpointand
for identifiers.<o:p></o:p></p>
<p class=MsoPlainText>PP> For the OP-endpoint we've also defined a lower
priority HTTP service<o:p></o:p></p>
<p class=MsoPlainText>PP> endpoint.<o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText> <o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>PP> Doconsumers actually go to the lower priority http
service<o:p></o:p></p>
<p class=MsoPlainText>PP> endpointautomatically if they fail in using the
https service? Is<o:p></o:p></p>
<p class=MsoPlainText>PP> thisspecified in the protocol? <o:p></o:p></p>
<p class=MsoPlainText> <o:p></o:p></p>
<p class=MsoPlainText> <o:p></o:p></p>
<p class=MsoPlainText>PP> Thanks again,<o:p></o:p></p>
<p class=MsoPlainText>PP> Immad<o:p></o:p></p>
<p class=MsoPlainText> <o:p></o:p></p>
<p class=MsoPlainText> <o:p></o:p></p>
<p class=MsoPlainText>PP> On 13/06/07, Johnny Bufu <johnny@sxip.com>
wrote: <o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>PP> On 13-Jun-07, at 2:03 PM, Josh Hoyt wrote:<o:p></o:p></p>
<p class=MsoPlainText> <o:p></o:p></p>
<p class=MsoPlainText>>>> Are there examples of https openid provider
out their? (thismight <o:p></o:p></p>
<p class=MsoPlainText>>>> be a<o:p></o:p></p>
<p class=MsoPlainText>>>> silly question)<o:p></o:p></p>
<p class=MsoPlainText>>><o:p> </o:p></p>
<p class=MsoPlainText>>> MyOpenID.com supports SSL, but works both ways.
For example, both<o:p></o:p></p>
<p class=MsoPlainText>>> https://josh.myopenid.com/and
http://josh.myopenid.com/ work.<o:p></o:p></p>
<p class=MsoPlainText> <o:p></o:p></p>
<p class=MsoPlainText>PP> Sxipper also uses SSL, both for the OP-endpoint
and for identifiers.<o:p></o:p></p>
<p class=MsoPlainText>PP> For the OP-endpoint we've also defined a lower
priority HTTP service<o:p></o:p></p>
<p class=MsoPlainText>PP> endpoint.<o:p></o:p></p>
<p class=MsoPlainText> <o:p></o:p></p>
<p class=MsoPlainText>PP> Identifiers are HTTPS-only though; providing both
HTTP and HTTPS <o:p></o:p></p>
<p class=MsoPlainText>PP> identifiers to a user may confuse them, because
they will end up<o:p></o:p></p>
<p class=MsoPlainText>PP> using different identities if they log into an RP
by presenting<o:p></o:p></p>
<p class=MsoPlainText>PP> "user.op.com" vs
"https://user.op.com".<o:p></o:p></p>
<p class=MsoPlainText> <o:p></o:p></p>
<p class=MsoPlainText> <o:p></o:p></p>
<p class=MsoPlainText>PP> Johnny<o:p></o:p></p>
<p class=MsoPlainText> <o:p></o:p></p>
<p class=MsoPlainText>PP> _______________________________________________<o:p></o:p></p>
<p class=MsoPlainText>PP> general mailing list<o:p></o:p></p>
<p class=MsoPlainText>PP> general@openid.net<o:p></o:p></p>
<p class=MsoPlainText>PP>
http://openid.net/mailman/listinfo/general<o:p></o:p></p>
<p class=MsoPlainText> <o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText> <o:p></o:p></p>
<p class=MsoPlainText> <o:p></o:p></p>
<p class=MsoPlainText> <o:p></o:p></p>
<p class=MsoPlainText> <o:p></o:p></p>
<p class=MsoPlainText>PP> -- <o:p></o:p></p>
<p class=MsoPlainText>PP> Cell: +1 617 449 8654<o:p></o:p></p>
<p class=MsoPlainText>PP> Skype: i.akhund<o:p></o:p></p>
<p class=MsoPlainText>PP> Blog:
http://immadsnewworld.blogspot.com <o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>PP>
_______________________________________________general<o:p></o:p></p>
<p class=MsoPlainText>PP> mailing<o:p></o:p></p>
<p class=MsoPlainText>PP>
listgeneral@openid.nethttp://openid.net/mailman/listinfo/general <o:p></o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText><o:p> </o:p></p>
<p class=MsoPlainText>_______________________________________________<o:p></o:p></p>
<p class=MsoPlainText>general mailing list<o:p></o:p></p>
<p class=MsoPlainText>general@openid.net<o:p></o:p></p>
<p class=MsoPlainText>http://openid.net/mailman/listinfo/general<o:p></o:p></p>
</div>
</body>
</html>