Re: FN-FORUM: SSL and certificates

date posted 4th August 2003 12:00

Thanks Richard.


On Sunday, August 3, 2003, at 11:20 PM, Richard Parratt wrote:

>
>> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=

>> Saturday 2nd August 2003 14:41:26
>> Re: FN-FORUM: SSL and certificates - Manjit Singh
>> [EMAIL REMOVED]
>>
>> Amazon does not appear to use CA's, no detering messages
>> there. What's
>> the score here?
>>
>
> Amazon's certificate *is* signed by Verisign - for some reason =
clicking
> IE's padlock doesn't give you this data - NS7 does.
>
> Are you clear on what a certificate does? What it isn't is a seal of
> approval for a business!
>
> Basically SSL uses public key encryption to ensure no-one can =
eavesdrop
> on (or change) data going between server and browser. One way to =
thwart
> this would be to have a "man-in-the-middle" device (like a proxy =
server)
> that does the following:
> - user accesses https://www.barclays.com
> - the proxy takes the request, reads the page from the real
> www.barclays.com and serves it up - decrypting and recrypting the data
> as it passes through.
> - thus the user thinks they have a secure connection
> - but the operator of the proxy can read anything!
>
> To prevent this, SSL signs part of the transaction using the server
> certificate. This allows the browser to validate that www.barclays.com
> is the real McCoy. If this fails, you get the "scary message"!
>
> So any browser has no way of knowing the difference between a
> "self-signed" cert and a random cert from a "man-in-the-middle". Hence
> they are only really a test tool.
>
> For a CA to operate, it needs to have a reference to its root
> certificate in MS browser (really OS) code. (and Netscape, Opera, =
etc).
> Only a few firms have this exalted status - hence their fairly high
> prices.
>
> The alternative to having your own SSL site for card transactions is a
> third party site (like Paypal or whatever). Here the shop will =
transfer
> to the payment site - the user then transacts with the payment site,
> which notifies the shop that they have paid. Typically you as a shop
> don't get to see how - you just get the money less a service charge.
>
> Hope this helps,
> Richard
>
>
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
> fido.net are pleased to sponsor these Freelancers messages. For all
> your web hosting needs check out http://www.fido.net/ with hosting
> packages starting from just =A346.95 a year including VAT.
> Free 0871 Fax2Email numbers also available online!
> http://www.fido.net/ - the internet made simple! - 0800 1072 666
>
> To advertise here: http://www.freelancers.net/advertising.html
>
>