.: 7:58 AM
posted by daddy-o

Netcraft: SSL's Credibility as Phishing Defense Is Tested

Poke around your browser's settings and see if you can turn off SSL encoding in 'plain text' to make your surfing experience a bit safer... I don't really see any other way around this issue besides inspecting every certificate you get....

"Scammers can also configure their web server so that deceptive SSL certificates won't trigger an alert in the user's browser. 'One of the SSL encoding methods is 'plain text',' Neal Krawetz from Secure Science Corporation noted in the SANS post on the issue. 'Most SSL servers have this disabled by default, but most browsers support it. When plain text is used, no central certificate authority is consulted and the user never sees a message asking if a certificate should be accepted (because 'plain text' doesn't use certificates). Keeping that in mind, the little lock icon may not even indicate an encrypted channel. The little lock only indicates an SSL connection.'"

read the rest

| Ask | Permalink

---