<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#ffffff">
On 10/29/2008 01:41 AM, Breno de Medeiros:<br>
<blockquote
cite="mid:29fb00360810281641l4142eb02ga255086528f07c5f@mail.gmail.com"
type="cite">
<pre wrap="">Take SSL: And
moreover most users have not configured their browsers to check CRLs.
So websites rely on clients to check CRLs, but they do not.
</pre>
</blockquote>
<br>
Just to set the record strait, but modern browsers check CRLs or
consult OCSP responders for validity by default. This is correct for
IE7, FF3, Opera and perhaps most others.<br>
<br>
<blockquote
cite="mid:29fb00360810281641l4142eb02ga255086528f07c5f@mail.gmail.com"
type="cite">
<pre wrap="">
PAPE is intended to assure honest RPs that the users are being
authenticated with non-phishable credentials. PAPE is _not_ intended
to protect users against phishing in general.</pre>
</blockquote>
<br>
PAPE doesn't protect against anything, it gives an opinion about the
authentication methods used. There is no authority or standards body
confirming implementations.<br>
<br>
<blockquote
cite="mid:29fb00360810281641l4142eb02ga255086528f07c5f@mail.gmail.com"
type="cite">
<pre wrap="">is only preventing phishing _of_the_credentials, not of anything else
that the user volunteers to enter somewhere.
</pre>
</blockquote>
<br>
Correct.<br>
<blockquote
cite="mid:29fb00360810281641l4142eb02ga255086528f07c5f@mail.gmail.com"
type="cite">
<pre wrap="">
Again, PAPE is restricted to:
--protection of login credentials
--leverage non-phishable (or more general, security 'level' type of
authentication) available in OP account to arrive at (non-phishable,
'security level' type of authentication) in RP accounts, assuming RP
trusts the OP to implement these measures.
</pre>
</blockquote>
Indeed.<br>
<br>
<br>
<br>
<div class="moz-signature">
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, <a href="http://www.startcom.org">StartCom Ltd.</a></td>
</tr>
<tr>
<td>Jabber: </td>
<td><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org">Join the Revolution!</a></td>
</tr>
<tr>
<td>Phone: </td>
<td>+1.213.341.0390</td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
<br>
</body>
</html>