full-disclosure - HTTP AUTH BASIC monowall

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200603161753.k2GHr1gb012574@turing-police.cc.vt.edu>
Date: Thu Mar 16 17:53:10 2006
From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks@...edu)
Subject: HTTP AUTH BASIC monowall 

On Wed, 15 Mar 2006 15:14:47 EST, Brian Eaton said:
> tim-security at sentinelchicken.org wrote:

> How trustworthy are the CA certificates included in the average browser?
> 
> There are a couple of dozen CA certificates shipped with my browser.
> Some of the vendors associated with these CA certificates offer to
> give me a certificate for my web site in 10 minutes or less for a
> couple of hundred dollars.
> 
> This sounds like a really ripe opportunity for social engineering to me.

Been there, done that already.  There was a phishing run a while ago,
the guys even had a functional SSL cert for www.mountain-america.net (the
actual bank was mntamerica.net or something like that..)

Only real solution there is to get a good grip on what a CA is actually
certifying, which is a certain (usually very minimal) level of
*authentication*. They're certifying that somebody convinced them that the cert
was for who they claimed it was for.  That's it.  Anybody who attaches any
*other* meaning to it is making a big mistake.  In particular, "authorization"
is totally out-of-scope here....

"You are now talking to the site that one of the CAs you trust thinks belongs
to Frobozz, Inc.".

If you don't trust that CA's judgment, you better heave their root cert overboard...

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060316/480c97ae/attachment.bin