full-disclosure - HTTP AUTH BASIC monowall

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu Mar 16 15:04:41 2006
From: tim-security at sentinelchicken.org (Tim)
Subject: HTTP AUTH BASIC monowall

> How trustworthy are the CA certificates included in the average browser?

Ah, well, that's another good topic of discussion, though I'm sure it
will just start a new thread of flames.

> There are a couple of dozen CA certificates shipped with my browser.
> Some of the vendors associated with these CA certificates offer to
> give me a certificate for my web site in 10 minutes or less for a
> couple of hundred dollars.
> 
> This sounds like a really ripe opportunity for social engineering to me.

Yes, I really don't trust the all-or-nothing SSL PKI myself.  If any
*one* CA certificate in your list is compromised, all SSL connections
you make from your browser could be compromised.  There's no way to say
"I trust this CA more than others", or to say you trust a given CA only
for certain domains (afaik).  It is also very centralized, which makes
it convenient for abuse by monopolies.

I haven't looked into it a whole lot, but does anyone know of
alternatives or ways of establishing webs of trust with SSL/TLS?

tim