Full Disclosure mailing list archives
Re: Slightly OT: What SSL cert do you consider strongest?
From: John Adams <jna () twitter com>
Date: Thu, 24 Oct 2013 10:23:13 -0700
You're forgetting about certificate pinning which defeats MiTM if the certificate is issued by an unauthorized CA. For example, here at Twitter we have certificate pinning in all of our clients to ensure SSL certificates are only signed by trusted CAs and as well as Chrome. Emerging standards like TACK and DANE will help greatly with this issue. -j On Wed, Oct 23, 2013 at 3:12 AM, <gremlin () gremlin ru> wrote:
On 22-Oct-2013 16:14:00 -0400, David Miller wrote: > After the PRISM and other Snowden leaks, inquiring minds want to > know: whose SSL certs are to be trusted? > Is a self-signed cert likely to be stronger? Obviously, yes: any issuer in any country may be forced (by local authorities) to issue a valid certificate for any host or domain, so no one will be able to distinguish between original host with updated certificate and MitM proxy operated by feds. -- Alexey V. Vissarionov aka Gremlin from Kremlin <gremlin ПРИ gremlin ТЧК ru> GPG: 8832FE9FA791F7968AC96E4E909DAC45EF3B1FA8 @ hkp://keys.gnupg.net _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Slightly OT: What SSL cert do you consider strongest? David Miller (Oct 23)
- Re: Slightly OT: What SSL cert do you consider strongest? Jeffrey Walton (Oct 23)
- Re: Slightly OT: What SSL cert do you consider strongest? gremlin (Oct 23)
- Re: Slightly OT: What SSL cert do you consider strongest? John Adams (Oct 24)
- Re: Slightly OT: What SSL cert do you consider strongest? Fabian Wenk (Oct 23)
- Re: Slightly OT: What SSL cert do you consider strongest? Alex (Oct 23)
- Re: Slightly OT: What SSL cert do you consider strongest? Fabian Wenk (Oct 23)
- Re: Slightly OT: What SSL cert do you consider strongest? Jeffrey Walton (Oct 24)
- Re: Slightly OT: What SSL cert do you consider strongest? Fabian Wenk (Oct 27)
- Re: Slightly OT: What SSL cert do you consider strongest? Alex (Oct 23)