Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email email@example.com
[Full-Disclosure] Looking for some input
From: Shannon Johnston (sjohnstonlibertysite.com)
Date: Thu May 27 2004 - 11:40:17 CDT
I posted this on the Dshield list a couple of days ago. Sorry to those of you who are seeing this again.
I'm looking for some input from the community at large on an issue that
has been bothering me for a while.
The institution where I do my banking has a login to an internet banking
page. While the login goes to an SSL enabled site, the login page is on
a non-SSL site. My question is: Doesn't this leave the members of the
institution open to phishing via DNS cache poisoning? Doesn't this
defeat the endpoint verification piece of an SSL certificate?
I'm looking for general input on this, so any replies are appreciated.
Full-Disclosure - We believe in it.