From owner-freebsd-current@FreeBSD.ORG  Wed Jun 21 07:02:54 2006
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
X-Original-To: freebsd-current@freebsd.org
Delivered-To: freebsd-current@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id B478816A57C;
	Wed, 21 Jun 2006 07:02:54 +0000 (UTC) (envelope-from rizzo@icir.org)
Received: from xorpc.icir.org (xorpc.icir.org [192.150.187.68])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 8C1EA43D4C;
	Wed, 21 Jun 2006 07:02:51 +0000 (GMT) (envelope-from rizzo@icir.org)
Received: from xorpc.icir.org (localhost [127.0.0.1])
	by xorpc.icir.org (8.12.11/8.12.11) with ESMTP id k5L72pc6006495;
	Wed, 21 Jun 2006 00:02:51 -0700 (PDT)
	(envelope-from rizzo@xorpc.icir.org)
Received: (from rizzo@localhost)
	by xorpc.icir.org (8.12.11/8.12.3/Submit) id k5L72oQb006494;
	Wed, 21 Jun 2006 00:02:50 -0700 (PDT) (envelope-from rizzo)
Date: Wed, 21 Jun 2006 00:02:50 -0700
From: Luigi Rizzo <rizzo@icir.org>
To: John Birrell <jb@what-creek.com>
Message-ID: <20060621000250.A6468@xorpc.icir.org>
References: <C41481BC-89F3-457E-9FD0-CB85CE7B93E7@eecs.cwru.edu>
	<4498D108.90907@rogers.com> <20060621053007.GA3320@odin.ac.hmc.edu>
	<4498DF20.8020803@rogers.com> <1150870137.78122.14.camel@spirit>
	<20060621082734.Q24109@beagle.kn.op.dlr.de>
	<20060621063816.GA32889@what-creek.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.2.5.1i
In-Reply-To: <20060621063816.GA32889@what-creek.com>;
	from jb@what-creek.com on Wed, Jun 21, 2006 at 06:38:16AM +0000
Cc: freebsd-current@freebsd.org, Harti Brandt <harti@freebsd.org>
Subject: Re: ~/.hosts patch
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
	<freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>, 
	<mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 21 Jun 2006 07:02:54 -0000

On Wed, Jun 21, 2006 at 06:38:16AM +0000, John Birrell wrote:
> On Wed, Jun 21, 2006 at 08:31:36AM +0200, Harti Brandt wrote:
> > Wouldn't this enable the same kind of phishing attacks there are under 
> > windows? As far as I remember there are attacks where the hosts file 
> > (don't remember how its called under windows) is rewriten by a virus/java 
> > script/whatever to contain a different IP address for a given hostname? 
> > Suppose someone fakes the website of www.foobank.com, then manages to 
> > insert www.foobank.com with the wrong IP address into ~/.hosts?
> 
> Ugh. Now that is a scary thought.

and that's why people use https and certificates!
what's the concern here ?

luigi