From: Shannon Johnston (sjohnstonlibertysite.com)
Date: Thu May 27 2004 - 11:40:17 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

I posted this on the Dshield list a couple of days ago. Sorry to those of you who are seeing this again.

I'm looking for some input from the community at large on an issue that
has been bothering me for a while.

The institution where I do my banking has a login to an internet banking
page. While the login goes to an SSL enabled site, the login page is on
a non-SSL site. My question is: Doesn't this leave the members of the
institution open to phishing via DNS cache poisoning? Doesn't this
defeat the endpoint verification piece of an SSL certificate?

I'm looking for general input on this, so any replies are appreciated.

Thank you,
Shannon Johnston

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]