full-disclosure - The merits and uses of CAs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <001d01c96f91$29738f30$7c5aad90$@co.uk>
Date: Mon, 5 Jan 2009 23:55:59 -0000
From: "Christopher Pritchard" <mailinglist@...iniacghost.co.uk>
To: <Valdis.Kletnieks@...edu>,
	"'Tim'" <tim-security@...tinelchicken.org>
Cc: full-disclosure@...ts.grok.org.uk
Subject: The merits and uses of CAs

>I believe I stated *up front* that it doesn't secure against an active MITM
attack.  Once ettercap presents a *different* >certificate than the one you
were expecting, the victim can at least potentially notice (the same way
that OpenSSH complains >if it discovers that a host key is different).

I think that using a self signed certificate should be OK and not throw up
any warnings, however it should not change the colour of the address bar (as
using valid certificates does in many modern browsers). I also feel that if
the certificate changes (a la SSH), it should throw up a warning, unless the
previous certificate became invalid (for example due to a date issue). It
should also be possible to have semi-centralised CRLs that browsers would
check for occasions when the server admin wants to change certificates, they
could post the old one up on the list and the browser wouldn't warn when a
new certificate is presented. HTTPS is more secure than HTTP in all
instances, we should not discourage the use of self signed certificates,
however we also should not portray them as more secure than they actually
are (which is protection against PASSIVE snooping), and things that require
proper security should use either properly signed (by a CA) certs or EV
ones.

Chris

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/