On 23-Jun-06, at 3:29 PM, Eric Rescorla wrote:
1. Capture-Resistant Credentials (CRC)
Credentials which are designed so that if you authenticate
to relying party (RP) X, X cannot use them to impersonate you to
RP Y
(even if your intention was to go to Y). Phishing is based
on the fact that passwords do not have this property.
The rationale for this feature is to make phishing-type
attacks difficult.
This is a bit confusing; to me (disclaimer -- I'm just a layman, not
a security expert), phishing is based on confusing the user about the
RP's identity, not reusing credentials from RP X with RP Y. Of
course, if you enable Common User Credentials, phishing will be
possible in this manner.
I see what you mean here, but let me try to explain what I'm
talking about and see if you still disagree with my taxonomy.
In a classic phishing attack, the attacker convinces you
to authenticate to them under the impression (in between
your ears) that you're authenticating to someone else. For
concreteness, say that the Phishing site is spoofing Citibank
and the Phishing site has domain name C1tibank.
The reason this works is that the authentication token that
your software sends to C1tibank (your password) is the same
as the token it sends to Citibank. In systems where these
are separated (e.g., Boneh's PwdHash) then phishing attacks
don't work. You can capture an authentication token but
you can't re-use it to impersonate the user to the real RP.
Part of the problem is that the user and the software have
a different view of the RP's identity. The software knows that
C1tibank and Citibank are different, but the user does not.
Minor clarification: I was at the recent Anti Phishing Working Group
meeting and many phishing attacks are gathering personal data in
addition to or instead of the user's password.
-- Dick
_______________________________________________
dix mailing list
[email protected]
https://www1.ietf.org/mailman/listinfo/dix
