The real problem that https has conspicuously failed to fix
I keep posting "you cannot do this using https", and people keep = replying "yes you can" No you cannot, cause if you could, paypal, e-gold, e-bay, and the rest = would not be suffering from the problem illustrated by scam mails such = as the following (When you hit the submit button, guess what happens) =20 =20 =20 Dear PayPal Customer=20 This e-mail is the notification of recent innovations taken by = PayPal to detect inactive customers and non-functioning mailboxes. The inactive customers are subject to restriction and removal in = the next 3 months. Please confirm your email address and Credit or Check Card = information using the form below: =20 Email Address: =20 Password: =20 First Name: =20 Last Name: =20 ZIP: =20 Credit or Check Card #: =20 Expiration Date: Month 01 02 03 04 05 06 07 08 09 10 11 12 / Year 2003 = 2004 2005 2006 2007 2008 2009 2010 2011 2012 =20 ATM PIN: =20 =20 Information transmitted using 128bit SSL encryption.=20 =20 =20 Thanks for using PayPal!=20 =20 =20 This PayPal notification was sent to this email address because = you are a Web Accept user and chose to receive the PayPal Periodical = newsletter and Product Updates. To modify your notification preferences, = go to https://www.paypal.com/PREFS-NOTI and log in to your account. = Changes may take several days to be reflected in our mailings. Replies = to this email will not be processed. =20 Copyright=A9 2003 PayPal Inc. All rights reserved. Designated = trademarks and brands are the property of their respective owners. =20 [demime 0.97c removed an attachment of type image/gif which had a name of paypal_logo.gif] [demime 0.97c removed an attachment of type image/gif which had a name of pixel.gif] [demime 0.97c removed an attachment of type image/gif which had a name of dot_row_long.gif]
also sprach James A. Donald <jamesd@echeque.com> [2003.06.08.2243 +0200]:
(When you hit the submit button, guess what happens)
How many people actually read dialog boxes before hitting Yes or OK? I know you do, and most of us, but who's the majority? -- martin; (greetings from the heart of the sun.) \____ echo mailto: !#^."<*>"|tr "<*> mailto:" net@madduck keyserver problems? http://keyserver.kjsl.com/~jharris/keyserver.html get my key here: http://madduck.net/me/gpg/publickey "my experience is that as soon as people are old enough to know better, they don't know anything at all." -- oscar wilde
On Sunday 08 June 2003 06:11 pm, martin f krafft wrote:
also sprach James A. Donald <jamesd@echeque.com> [2003.06.08.2243 +0200]:
(When you hit the submit button, guess what happens)
How many people actually read dialog boxes before hitting Yes or OK?
It's slightly more subtle. The action tag of a form submission isn't usually visible to the user like links are. In the scam copy I received, all the links save one pointed to legitimate PayPal documents. Only the <form action= gave it away, and you have to view source to see that.
Folks, this isn't an https (or even http) problem. It is a tough user interface issue. Note: The form posting goes to www.pos2life.biz, which doesn't remotely look like paypal.com! To make matters worse, there are plenty of businesses that send you leg imitate email that comes from a "random" looking place. Just today I received one from MIT's Alumni Association, but the actual source was something like m0.email-foobar.com (or something). Obviously the Alumni Association outsources the sending of the mail to some third party company. So even if we came up with some fancy was of saying "This form doesn't post to the same place this page came from [never mind that the original of an e-mail form is ill defined]" won't help. I also received this scam mail. There were only two hints of badness (besides the obvious request for personal info that paypal shouldn't need) one was the form posting and the other was the "Received-by" line which my mail system put on the message which showed its original at a suspicious place (I believe in Japan, but I may have remembered wrong, it didn't look right at the time). This is a social problem. Technical measures can help, but won't solve it, I am afraid. -Jeff Roy M.Silvernail wrote:
On Sunday 08 June 2003 06:11 pm, martin f krafft wrote:
also sprach James A. Donald <jamesd@echeque.com> [2003.06.08.2243 +0200]:
(When you hit the submit button, guess what happens)
How many people actually read dialog boxes before hitting Yes or OK?
It's slightly more subtle. The action tag of a form submission isn't usually visible to the user like links are. In the scam copy I received, all the links save one pointed to legitimate PayPal documents. Only the <form action= gave it away, and you have to view source to see that.
--------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo@metzdowd.com
participants (4)
-
James A. Donald
-
Jeffrey I. Schiller
-
martin f krafft
-
Roy M.Silvernail