On Sep 12, 2011, at 5:48 00PM, James A. Donald wrote:
> --
> On 2011-09-11 4:09 PM, Jon Callas wrote:
> > The bottom line is that there are places that continuity
> > works well -- phone calls are actually a good one. There
> > are places it doesn't. The SSL problem that Lucky has
> > talked about so well is a place where it doesn't. Amazon
> > can't use continuity. It is both inconvenient and insecure.
>
> Most people who login to Amazon have a long existing relationship: Hence key
> continuity and SRP would work well.
>
The problem with key continuity (and I alluded to this the other
day) is the tendency of people to just click "OK" to error
boxes. From the perspective of many people, the choice is the
inability to visit, say, Amazon, and clicking "OK" to an error
message they find to be quite incomprehensible. Furthermore,
they're probably right; most of the certificate errors I've
seen over the years were from ordinary carelessness or errors,
rather than an attack; clicking "OK" is *precisely* the right
thing to do.
--Steve Bellovin, https://www.cs.columbia.edu/~smb
_______________________________________________
cryptography mailing list
cryptography@randombit.net
http://lists.randombit.net/mailman/listinfo/cryptography
