full-disclosure - HTTP AUTH BASIC monowall.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20060313230410.GG3298@sentinelchicken.org>
Date: Mon Mar 13 23:04:26 2006
From: tim-security at sentinelchicken.org (Tim)
Subject: HTTP AUTH BASIC monowall.

> You said this is a firewall box. Most "appliances" I've seen use 
> self-signed SSL certs which don't validate anyway -- so you're ALREADY 
> used to clicking "ok" on the warning. Therein lies the danger I suppose.

Exactly.  This is probably why Simon is confused.  However, if he
verifies the fingerprint/hash of the certificate once (by walking over
to his firewall and reading it off the terminal), then he permanently
trusts it in his browser, then he'll be pretty safe from then on.

tim