Viewing profile — cantfindmypass

Correct, they cannot compute SHA256() or SHA256(SHA256()) of arbitrary data.

Someone showed me this a while ago. Apparently it's an actual attack. https://www.youtube.com/watch?v=G50typU3mLg

> I suspect they have a base OS installation and then have a post-boot encrypted partition which requires manual passphrase entry over ssh or console to unlock, containing all the …

Being able to rebind the keys would be really nice. The keys are decently intuitive, but it sucks pretty bad if you have a split keyboard.

Apple has had a working gotofail fix for OS X internally for days.

the only source of this appears to be the updated whois information...

The percentage of sites using SHA256 certificate is tiny, and most CAs are still SHA1 based.

That is a different bug.

I would be totally happy to put a proper stylesheet and some better copy together if someone wants to send me that (put it in a gist maybe?)

I am now for informational purposes linking to the OS X patch released by i0n1c. http://www.sektioneins.de/en/blog/14-02-22-Apple-SSL-BUG.htm...

I'm not checking for Safari vs OS X. I'm not sure what else to say to vulnerable OS X users - there is not really any effective mitigation besides turning the computer off.

It became widely known outside of Apple due to the iOS patch.

Yes, removing one line would fix it.

The issue is that Apple's security engineers must have realized that there was a good chance someone would reverse engineer the patch, and from there find out the OS X is also vuln…

Apple still hasn't released a fix for OS X...

My web logs show lots of systems identifying as 10.9.2 pulling the test image from the bad server.

I just noticed that his works differently than mine.

Yes, the bug is a regression introduced in Mavericks.

I don't know - I can't imagine that nobody on their security team pointed out that someone would promptly reverse engineer the patch and figure out that OS X is also vulnerable.

There's not a whole lot I can do about that without adding a lot of complexity. You could try downloading https://gotofail.com:1266/test.png I suppose.

I wanted to make something that gives something a little more useful than an error page if you're safe.

I started making this before agl released that, though he had that up before I finished. Also, upon closer inspection, mine actually works differently from agl's.

No OS X patch is available yet. :-( Chrome/Firefox shouldn't be vulnerable.

There is no patch for Mavericks out yet. :-(