1. Trust is a Two-Way Street Ebony Buckley
Problem
Despite many warnings and much advice about determining the validity of a website, users are still duped by even the most unsophisticated spoofing attempts.
The traditional one-sided approach where solely the server does authentication is no longer sufficient in the face of growing malicious use of the WWW. It is now vital that both sides are active participants in the authentication process.
Impact
Spoofing attempts will be harder to pull off because the client’s side is actively involved in the authentication process.
Approach
Thesis: The site encrypts a message with its private key and then with the user’s public key. The user decrypts the message and then obtains the server’s public key from a trusted key authority to decrypt the message.
Implementation: The user’s browser can ensure that this protocol is followed with very little input from the user. A system could be prototyped using browsers that allow plug-ins to be written and a test certificate server.