Full Disclosure mailing list archives
Re: HTTP AUTH BASIC monowall
From: Tim <tim-security () sentinelchicken org>
Date: Thu, 16 Mar 2006 10:04:33 -0500
How trustworthy are the CA certificates included in the average browser?
Ah, well, that's another good topic of discussion, though I'm sure it will just start a new thread of flames.
There are a couple of dozen CA certificates shipped with my browser. Some of the vendors associated with these CA certificates offer to give me a certificate for my web site in 10 minutes or less for a couple of hundred dollars. This sounds like a really ripe opportunity for social engineering to me.
Yes, I really don't trust the all-or-nothing SSL PKI myself. If any *one* CA certificate in your list is compromised, all SSL connections you make from your browser could be compromised. There's no way to say "I trust this CA more than others", or to say you trust a given CA only for certain domains (afaik). It is also very centralized, which makes it convenient for abuse by monopolies. I haven't looked into it a whole lot, but does anyone know of alternatives or ways of establishing webs of trust with SSL/TLS? tim _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- HTTP AUTH BASIC monowall Brian Eaton (Mar 16)
- Re: HTTP AUTH BASIC monowall Tim (Mar 16)
- Re: HTTP AUTH BASIC monowall Valdis . Kletnieks (Mar 16)
- Re: HTTP AUTH BASIC monowall bkfsec (Mar 16)
- Re: HTTP AUTH BASIC monowall Tim (Mar 16)
- Re: HTTP AUTH BASIC monowall bkfsec (Mar 17)
- Re: HTTP AUTH BASIC monowall Tim (Mar 17)
- Re: HTTP AUTH BASIC monowall bkfsec (Mar 16)
- Re: HTTP AUTH BASIC monowall Simon Smith (Mar 17)
- Re: HTTP AUTH BASIC monowall Brian Eaton (Mar 17)
- Re: HTTP AUTH BASIC monowall Valdis . Kletnieks (Mar 16)
- Re: HTTP AUTH BASIC monowall Brian Eaton (Mar 16)
- Re: HTTP AUTH BASIC monowall Valdis . Kletnieks (Mar 16)