On Sep 12, 2011, at 5:48 00PM, James A. Donald wrote: > -- > On 2011-09-11 4:09 PM, Jon Callas wrote: > > The bottom line is that there are places that continuity > > works well -- phone calls are actually a good one. There > > are places it doesn't. The SSL problem that Lucky has > > talked about so well is a place where it doesn't. Amazon > > can't use continuity. It is both inconvenient and insecure. > > Most people who login to Amazon have a long existing relationship: Hence key > continuity and SRP would work well. > The problem with key continuity (and I alluded to this the other day) is the tendency of people to just click "OK" to error boxes. From the perspective of many people, the choice is the inability to visit, say, Amazon, and clicking "OK" to an error message they find to be quite incomprehensible. Furthermore, they're probably right; most of the certificate errors I've seen over the years were from ordinary carelessness or errors, rather than an attack; clicking "OK" is *precisely* the right thing to do.
--Steve Bellovin, https://www.cs.columbia.edu/~smb _______________________________________________ cryptography mailing list cryptography@randombit.net http://lists.randombit.net/mailman/listinfo/cryptography