Re: ~/.hosts patch

From: Luigi Rizzo <rizzo_at_icir.org>
Date: Wed, 21 Jun 2006 00:20:36 -0700
On Wed, Jun 21, 2006 at 07:07:39AM +0000, John Birrell wrote:
> On Wed, Jun 21, 2006 at 12:02:50AM -0700, Luigi Rizzo wrote:
> > On Wed, Jun 21, 2006 at 06:38:16AM +0000, John Birrell wrote:
> > > On Wed, Jun 21, 2006 at 08:31:36AM +0200, Harti Brandt wrote:
> > > > Wouldn't this enable the same kind of phishing attacks there are under 
> > > > windows? As far as I remember there are attacks where the hosts file 
> > > > (don't remember how its called under windows) is rewriten by a virus/java 
> > > > script/whatever to contain a different IP address for a given hostname? 
> > > > Suppose someone fakes the website of www.foobank.com, then manages to 
> > > > insert www.foobank.com with the wrong IP address into ~/.hosts?
> > > 
> > > Ugh. Now that is a scary thought.
> > 
> > and that's why people use https and certificates!
> > what's the concern here ?
> 
> The fact that a lot of innocent (naive) people don't use https and certificates?!

and so they would happily click on

	<a href="http://www.666.org/gimmeyourmoney">Secure Link to Your Bank</a>

so we are not opening much in terms of security holes...

	cheers
	luigi
Received on Wed Jun 21 2006 - 05:20:41 UTC

This archive was generated by hypermail 2.4.0 : Wed May 19 2021 - 11:38:57 UTC