The Problem With Using End-to-End Web Crypto as a Cure-All

fsterman writes: Since the Snowden revelations, end-to-end web encryption has become trendy. There are browser add-ons that bolt a PGP client onto webmail and both Yahoo and Google are planning to support PGP directly. They attempt to prevent UI spoofing with icons similar to the site-authentication banks use to combat phishing.

The problem is that a decade of research shows that users habituate to these icons and come to ignore them. An attacker can pull off UI spoofing with a 90%+ success rate.

Comments

Re:nope

[theshowmecanuck]

Fix your users... Heh heh...

Re:Provided your MUA supports S/MIME

[iluvcapra]

And StartCom has been handing out S/MIME certificates without charge.

I probably wouldn't be interested in a CA that gave me my cert, I'd rather have one that signed one I generated :)