Full Disclosure mailing list archives
The merits and uses of CAs
From: "Christopher Pritchard" <mailinglist () brainiacghost co uk>
Date: Mon, 5 Jan 2009 23:55:59 -0000
I believe I stated *up front* that it doesn't secure against an active MITM
attack. Once ettercap presents a *different* >certificate than the one you were expecting, the victim can at least potentially notice (the same way that OpenSSH complains >if it discovers that a host key is different). I think that using a self signed certificate should be OK and not throw up any warnings, however it should not change the colour of the address bar (as using valid certificates does in many modern browsers). I also feel that if the certificate changes (a la SSH), it should throw up a warning, unless the previous certificate became invalid (for example due to a date issue). It should also be possible to have semi-centralised CRLs that browsers would check for occasions when the server admin wants to change certificates, they could post the old one up on the list and the browser wouldn't warn when a new certificate is presented. HTTPS is more secure than HTTP in all instances, we should not discourage the use of self signed certificates, however we also should not portray them as more secure than they actually are (which is protection against PASSIVE snooping), and things that require proper security should use either properly signed (by a CA) certs or EV ones. Chris _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: FD / lists.grok.org - bad SSL cert, (continued)
- Re: FD / lists.grok.org - bad SSL cert Adrenalin (Jan 05)
- Re: FD / lists.grok.org - bad SSL cert chort (Jan 05)
- Re: FD / lists.grok.org - bad SSL cert James Matthews (Jan 05)
- Re: FD / lists.grok.org - bad SSL cert Tim (Jan 05)
- Re: FD / lists.grok.org - bad SSL cert Valdis . Kletnieks (Jan 05)
- Re: FD / lists.grok.org - bad SSL cert Tim (Jan 05)
- Re: FD / lists.grok.org - bad SSL cert Valdis . Kletnieks (Jan 05)
- Re: FD / lists.grok.org - bad SSL cert Tim (Jan 05)
- Re: FD / lists.grok.org - bad SSL cert Valdis . Kletnieks (Jan 05)
- Re: FD / lists.grok.org - bad SSL cert Tim (Jan 05)
- The merits and uses of CAs Christopher Pritchard (Jan 05)
- Re: The merits and uses of CAs Valdis . Kletnieks (Jan 05)
- Re: FD / lists.grok.org - bad SSL cert Tim (Jan 05)
- Re: FD / lists.grok.org - bad SSL cert Tim (Jan 05)
- Re: FD / lists.grok.org - bad SSL cert chort (Jan 05)
- Re: FD / lists.grok.org - bad SSL cert Volker Tanger (Jan 05)
- Re: FD / lists.grok.org - bad SSL cert Tim (Jan 05)
- Re: FD / lists.grok.org - bad SSL cert Avraham Schneider (Jan 06)
- Re: FD / lists.grok.org - bad SSL cert Tim (Jan 05)
- Re: FD / lists.grok.org - bad SSL cert anonymous pimp (Jan 05)