cryptoanarchy.wiki

Arise, you have nothing to lose but your barbed wire fences!

1997-04-12 - Re: SSL weakness affecting links from pa

Header Data

From: Bill Stewart <stewarts@ix.netcom.com>
To: ARTURO GRAPA YSUNZA <AGRAPA@banamex.com>
Message Hash: 8c1db1e260856d8a95f59fbe39ec6a88de8456e69553dd0143dc2b44066bba72
Message ID: <3.0.1.32.19970411230142.00643490@popd.ix.netcom.com>
Reply To: <c=MX%a=_%p=BANACCI%l=CENTRALES/BARRANCA24/00015C5B@mex3976bcaop1.banamex.com>
UTC Datetime: 1997-04-12 06:03:06 UTC
Raw Date: Fri, 11 Apr 1997 23:03:06 -0700 (PDT)

Raw message

From: Bill Stewart <stewarts@ix.netcom.com>
Date: Fri, 11 Apr 1997 23:03:06 -0700 (PDT)
To: ARTURO GRAPA YSUNZA <AGRAPA@banamex.com>
Subject: Re: SSL weakness affecting links from pa
In-Reply-To: <c=MX%a=_%p=BANACCI%l=CENTRALES/BARRANCA24/00015C5B@mex3976bcaop1.banamex.com>
Message-ID: <3.0.1.32.19970411230142.00643490@popd.ix.netcom.com>
MIME-Version: 1.0
Content-Type: text/plain


At 01:54 AM 4/11/97 -0500, ARTURO GRAPA YSUNZA <agrapa@banamex.com> wrote:
>See http://www.Microsoft.com/security/
>under "Credit Card Security Concerns and Microsoft's Response"
>for Microsoft's response on the SSL GET/POST weakness. ¿Any opinions?

Thanks for the pointer to MS's security site; there's a lot of
good information there.

I was highly unimpressed with Microsoft's Response:
	"It's Not A Security Flaw"
	"But Everybody Important Works Around It"
	"And we're fixing it in the next release"
without providing much detail about what's going on.
It does indicate what to look into to avoid it when writing web pages,
but it doesn't say how to avoid it when entering your credit card number
into a web page, or what to look for as a non-programmer user.


#			Thanks;  Bill
# Bill Stewart, +1-415-442-2215 stewarts@ix.netcom.com
# You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp
#     (If this is a mailing list, please Cc: me on replies.  Thanks.)

Thread