<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
<title></title>
</head>
<body text="#000000" bgcolor="#ffffff">
On 05/08/2009 07:27 AM, SitG Admin:
<blockquote cite="mid:f06110400c62961ad0338@%5B192.168.0.2%5D"
type="cite">I've been trying to go from "reasonable security" to
"maximum security", and it's driving me up the proverbial wall.
Spoofing (of DNS), where SSL is absent, has two forms that I can see:
one is to spoof the OP client-side, and that much can I can at least
hold users responsible for - they need to look for that lock icon, and
respond cautiously to bad certs. But it's *RP*-side that gets more
complicated, if the URI itself is not served over SSL, because if the
*server* gets fooled it will happily allow the "user" to authenticate
with a new OP that has a perfectly valid and legitimate cert. So, while
I'm not worried about a user giving away the credentials with their OP
to an attacker, I *am* worried about an attacker posing as the user and
tricking my server into accepting that claim.
<br>
<br>
If the URI doesn't have SSL, it seems somewhat less than useless to put
effort into supporting SSL for OP's. If the attacker is going to go to
all the trouble of spoofing my server to pretend to be an OP, they
might as well do it for the URI, in which case SSL won't help.
<br>
<br>
<br>
</blockquote>
<br>
It's hard to spoof the delegation and server if secured over an SSL and
chaining to a "trusted" root is enforced. A DNS attack on your RP would
then fail which would not if the OP doesn't enforce SSL. This scenario
is rather easy once the DNS server(s) are poisoned.<br>
<br>
<br>
<div class="moz-signature">
<table cellpadding="0" cellspacing="0" border="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, <a href="http://www.startcom.org">StartCom Ltd.</a></td>
</tr>
<tr>
<td>Jabber: </td>
<td><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org">Join the Revolution!</a></td>
</tr>
<tr>
<td>Phone: </td>
<td>+1.213.341.0390</td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
<br>
</body>
</html>