how can you verify that the site you get is not a fake?

[Matthew Miller]

On Mon, Jun 06, 2005 at 06:48:31AM -0700, bruce wrote:
> matt, i unsderstand what you're saying...
> but i still don't see how this protects/allows a user to 'know' that th site
> he's on is the correct site...
> as an example. i go to the verisign site (www.verisign.com) i can select the
> verisign logo, which displays a pop-up. i read it, it looks good.. i think
> i'm secure...
> however, there's nothing that i look at, that couldn't be forged/faked by
> you or i with the right web app knowledge...

Sure. But go to <https://www.verisign.com/> isntead.

> i understand that the 'ssl/lock' is a function of the browser and is
> supposed to be used to present details of the ssl certificate employed... i
> also understand that the lock function is a component of the browser...
> however, this asumes the user knows to click on the 'lock'. if i were to
> provide a fake 'picture/icon' for the user to select, such that it displayed
> the fake ssl information, in all likelyhood, the user wouldn't know the
> difference..

Um, this is a switch. Now you're asking: "How can I make all possible idiots
in the world know" rather than "How can *I* know". Obviously one has to know
about and use the browser's security features for this to work.

You (as a malicious website) can't provide a fake SSL icon, because you
don't control the frame of the web browser, just the page contents. If the
user is tricked by some graphic you've done up and put on the site, yeah,
not much to do about that.

-- 
Matthew Miller           mattdm at mattdm.org        <http://www.mattdm.org/>
Boston University Linux      ------>                <http://linux.bu.edu/>
Current office temperature: 80 degrees Fahrenheit.