S/MIME in Outlook -- fucked.

[James A. Donald]

    --
On 3 Sep 2002 at 11:16, Meyer Wolfsheim wrote:
> I encourage everyone to send Bill Gates an email from
> himself.  =)
>
> =============================================================
> ========= ==== Vendor Notification Status
>
> Microsoft knows about this, of course, but "isn't even sure
> whether to call this a 'vulnerability'."  Right.

While the immediate bug is in Microsoft IE and Outlook, this
exploit is also a reflection of the contorted mess that is the
certificate structure and the public key infrastructure, and of
the fact that Verisign is not doing its job.  (This exploit
only works if one starts with a legitimate verisign certificate
for a web site, it does not work if one starts with a
legitimate Thawte certificate.)

Microsoft unambiguously screwed up, but the infrastructure made
it easy to screw up, and difficult and expensive to get things
right. 

    --digsig
         James A. Donald
     6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG
     2S6sg825yJSZ69s23KyOvpaHYYQYbgoRuPl2j1JZ
     24hZwF+YmQMFl2hK8LOkiesmNrg+xJ0ZdA1qPUzQU