Hi Eliot -
I think we are actually on the same page regarding section 3.1, and this
is just a terminology question. What you consider "private" is the
personal data desired by the attacker, whereas I was considering this to
be the user's username and password.
Mechanisms attackers use to accomplish this include links with a
misleading name or URI, which they may distribute in emails;
attacks against DNS; and man-in-the-middle attacks against a TLS
handshake. The former two attacks allow the attacker to pass
authentication because the victim user can be tricked into
accepting the attacker's certificate. The latter attack will
typically create a warning on the victim user's side, but many
users cannot make informed decisions on how to respond to such a
warning, making them inclined to accept the bogus certificate.
I do like this text, with the exception that I would replace "cannot
make informed decisions" with "do not make informed decisions". And
indeed you have hit the nail on the head here IMHO.
Yes, that replacement makes sense.
Alright, take care,
- Christian
_______________________________________________
Gen-art mailing list
[email protected]
https://www1.ietf.org/mailman/listinfo/gen-art
