Tanguy Ortolo

monday 15 october 2012 à 20:14 Tanguy said : #1

You may object that one should never follow the instructions from email that appear to be from the bank. This is generally true, but it does not void this flaw, which can apply to other processes, such as a « login with Facebook » on a website, which could redirect to a fake Facebook login page on the same website.

monday 15 october 2012 à 22:36 Tanguy said : #4

@Guillaume : Probably, although I am really not a fan of the EV system, aka “we the certification authority really did shit in the past, so buy these expensive first class certificates which guarantee we do not do the same shit with you”. However, that would not really solve the problem until all the certificates of good people in the world become EV and the regular ones can stop being supported. Also, with the opacity the the X.509 system, I do not know what would guarantee that a phisher would not get one. And finally, the possibility of cracking an EV site to host a phishing site cannot never be ruled out.

monday 15 october 2012 à 22:46 Tanguy said : #5

@glandium : No, this is the last available build for GNU/Linux i386, available at http://www.mozilla.org/fr/mobile/ . Version Fennec 4.0.1 as it appears to be.

tuesday 16 october 2012 à 12:00 Tanguy said : #10

@glandium : Too bad there is no longer a way to test it without having to buy an appropriate mobile phone then. I would not have been able to take those screenshots without that obsolete but presented as up-to-date GNU/Linux version. It should be removed indeed, because it is really misleading.

@Gabriel : Actually I am. I have several types of passwords, ranging from very secure to not really secure for systems that do not accept special characters, and one very unsecure password for lame systems that only accept a handful of digits, or to name them: banks. Fortunately they use a counter that burns the login after three unsuccessful login trials, which limits the brute force attack vulnerability.

tuesday 16 october 2012 à 12:07 Tanguy said : #11

@Guillaume, @Gabriel, this attack is not limited to banks, for instance replace the bank website by a blog, with a « login with facebook » button for comments, redirecting to something that looks like a Facebook login page.

@Chris Cunningham : Well, this page does not exist, so this is only a fictitious example. Simply consider that the evil pirate can wery well secure its phishing website with a perfectly valid certificate for his domain name “evilpirate.net”. Now, I am not sure of what you mean by “random binaries they download off random FTP sites”, perhaps you should be more specific.