full-disclosure - Re: Expired certificate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <15343.1279306498@localhost>
Date: Fri, 16 Jul 2010 14:54:58 -0400
From: Valdis.Kletnieks@...edu
To: Dimitry Andric <dimitry@...ric.com>
Cc: full-disclosure@...ts.grok.org.uk, Daniel Sichel <daniels@...derosatel.com>
Subject: Re: Expired certificate

On Fri, 16 Jul 2010 20:06:24 +0200, Dimitry Andric said:

> That is definitely not the only reason.  The longer a certificate (or
> actually, any 'secret key') is being used, the larger the probability
> that it will be compromised, either by an opponent brute-forcing it, or
> by good ole' human error.

Of course, a cert that expires once a year for that purpose only really helps
those sites that have been pwned and their secret keys known for months without
the site learning about it.  It used to be "change passwords once a month" to
close down exposures of shoulder-surfed passwords (where an attacker might only
learn 2-3 chars of the password each attempt) and minimize the window a
password could be used (remember, auditing still sucked back in those days).
Doesn't mean it still addresses any real threat in today's environments.  Gene
Spafford wrote some nice articles about this on his blog a while ago:

http://www.cerias.purdue.edu/site/blog/post/password-change-myths/
http://www.cerias.purdue.edu/site/blog/post/passwords-and-myth/

> Another reason is, of course, to guarantee steady income for the
> certificate vendors... ;)

You blew their cover. Now they'll have to kill you. :)

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/