full-disclosure - Re: Slightly OT: What SSL cert do you consider strongest?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAMTPRkP_x1g42R-m751u9PEAbSZBKoT5XLdq2kP-f7cpZ7S-CQ@mail.gmail.com>
Date: Thu, 24 Oct 2013 10:23:13 -0700
From: John Adams <jna@...tter.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Slightly OT: What SSL cert do you consider
	strongest?

You're forgetting about certificate pinning which defeats MiTM if the
certificate is issued by an unauthorized CA.

For example, here at Twitter we have certificate pinning in all of our
clients to ensure SSL certificates are only signed by trusted CAs and as
well as Chrome.

Emerging standards like TACK and DANE will help greatly with this issue.

-j

On Wed, Oct 23, 2013 at 3:12 AM, <gremlin@...mlin.ru> wrote:

> On 22-Oct-2013 16:14:00 -0400, David Miller wrote:
>
>  > After the PRISM and other Snowden leaks, inquiring minds want to
>  > know: whose SSL certs are to be trusted?
>  > Is a self-signed cert likely to be stronger?
>
> Obviously, yes: any issuer in any country may be forced (by local
> authorities) to issue a valid certificate for any host or domain,
> so no one will be able to distinguish between original host with
> updated certificate and MitM proxy operated by feds.
>
>
> --
> Alexey V. Vissarionov aka Gremlin from Kremlin <gremlin ПРИ gremlin ТЧК ru>
> GPG: 8832FE9FA791F7968AC96E4E909DAC45EF3B1FA8 @ hkp://keys.gnupg.net
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/