Monday, 09. September 2002
SSL does not protect your credit card transactions.
There was this nasty SSL/TLS-Certificate validation bug. So now MS NBC is spreading "FUD": Windows flaw enables credit fraud. Attackers could use the use the flaw to get your credit card number.
In the mid-ninties there where people planning to do commerce on the Internet. They where told they can't do it, because the Internet "is not secure". - Oh not secure! Encryption makes stuff secure. So we encrypt the transactions via SSL and everything is secure - nobody could sniff your data from the wire. So users where told they should look for a little key icon in their browser and if it's there the site "is secure" and they shoul start shopping as mad.
The problem is: nobody is sniffing credit card numbers off the wire. All the bad guys just r00t the servers and grap thousands of credit card numbers from there. So broken SSL is not a risk to credit card numbers but poor host security is.
02:56 |
#
disLEXia, a research project by Maximillian Dornseif
 |  |  | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 |
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 |  |  | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||