full-disclosure - Re: Expired certificate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1260cc10ec7684a9807dbdc4ea6579c0@mail.gmail.com>
Date: Fri, 16 Jul 2010 13:15:52 -0400
From: Larry Seltzer <larry@...ryseltzer.com>
To: Daniel Sichel <daniels@...derosatel.com>, full-disclosure@...ts.grok.org.uk
Subject: Re: Expired certificate

It's better than nothing, but it speaks ill of the agency. Yes, the
encryption is the same.

Certificates have expiration dates so that the verification that happens
at the time the cert is acquired can have some "freshness." So if it's
just expired, well it's no biggie, especially if this is a plain SSL
certificate which doesn't verify all that much anyway.

-----Original Message-----
From: full-disclosure-bounces@...ts.grok.org.uk
[mailto:full-disclosure-bounces@...ts.grok.org.uk] On Behalf Of Daniel
Sichel
Sent: Friday, July 16, 2010 1:10 PM
To: full-disclosure@...ts.grok.org.uk
Subject: [Full-disclosure] Expired certificate

OK, I am in the Golden state (California) where things are not so golden
at the moment.
I deal with a state agency and use their "secure" ftp site.
Their certificate has expired and won't be renewed for a few weeks, but
they want me to continue to ftp stuff
Using their expired cert.

So, as a relative n00b,  what are the risks?

Does it still encrypt even though, obviously, it can't be verified?

My guess is that this still encrypts, but there is no authentication,
possibly creating a man in the middle opportunity for some
Nefarious person with evil intent (nobody I know, or who is on this
list, of course).

Anyway, any info would be welcome from the cognoscenti who subscribe
here.

Thanks,
Dan Sichel

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/