full-disclosure - Re: Firefox 2.0.x: tracking unsuspecting users using TLS client certificates

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <46E1830D.4090602@startcom.org>
Date: Fri, 07 Sep 2007 19:57:49 +0300
From: "Eddy Nigg (StartCom Ltd.)" <eddy_nigg@...rtcom.org>
To: Alexander Klink <a.klink@...ops.de>
Cc: full-disclosure@...ts.grok.org.uk, dev-security@...ts.mozilla.org,
	dev-tech-crypto@...ts.mozilla.org
Subject: Re: Firefox 2.0.x: tracking unsuspecting users
	using TLS	client	certificates

Hi Alexander,

Alexander Klink wrote:
> Granted, if this is a "real" CA. But if you use it like in my PoC not
> for the typical CA scenario, but for user tracking, you could put all
> kinds of data in the certificate.
>   
That's right. Still I believe that the generation of a private key and 
issuance of the certificate is pretty "noisy". However I agree, some 
explanation would be better. Obviously on a CA, this process is 
explained at the web site, but as in your scenario, the user isn't 
supposed to know a lot about it....There is something to your claim....
> Tracking visitors in an unnoticed way over several domains is typically
> not as easy as this, I believe.
>   
Well ,well... ;-)
> I've actually tested that again and it also works in Firefox 1.5 - and
> even "better" there, because the certificate installation does not show
> any dialog at all. 
Right! In 1.5 no "Installation Message" appears, which in 2.0 has been 
corrected. I suggest to file a bug with the request to change the 
default settings for handling certificate authentication. Please send 
the bug number, so we can vote for it...

-- 
Regards 
 
Signer:  	Eddy Nigg, StartCom Ltd. <http://www.startcom.org>
Jabber:  	startcom@...rtcom.org <xmpp:startcom@...rtcom.org>
Blog:  	Join the Revolution! <http://blog.startcom.org>
Phone:  	+1.213.341.0390
 


Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/