Iran forged the wrong SSL certificate

Post by arethuza » Thu, Sep 01, 2011, 12:58 PM UTC

StavrosK wrote: post #50

arethuza wrote: post #20

Earlier quoted context omitted.

As far as I can see this isn't a fundamental problem with SSL, but the fact that most environments come pre-installed with certificates for CAs that aren't really worthy of trust. [Edit: Certainly looking through the list of Trusted Root CA certs on this machine I have no idea who 95% of these organisations are - I also have a certificate installed by a proxy so it can intercept any SSL traffic and inspect the conten…

Then that is a fundamental problem with SSL. I am very partial to the Perspectives[1] solution. I wish it would gain more wide-spread support... [1]: http://perspectives-project.org/

Post by caf » Thu, Sep 01, 2011, 1:37 PM UTC

robtoo wrote: post #47

xorglorb wrote: post #36

Earlier quoted context omitted.

There is no approval process, no central authority. If you want your CA in OS X, you talk to Apple, if you want it in Windows, you talk to Microsoft. If you want it in Firefox, you talk to Mozilla.

All vendors want market share in the Netherlands, so a few Dutch CAs get on the list; and they all want market share in China so the Chinese Ministry of Information gets on the list. No browser wants to be the one which doesn't work with someone, somewhere's bank, so once you're on one list, you tend to get added to all of them; and it becomes nigh-on impossible for marketing reasons to remove anyone from the list ev…

Post by ig1 » Thu, Sep 01, 2011, 1:51 PM UTC

jgrahamc wrote: post #33

This is something I've been talking about for a while. Back in 2009 I gave a presentation at Virus Bulletin on JavaScript security problems and highlighted some statistics on remotely loaded JavaScript: 1. 47% of the top 1,000 web sites include google-analytics.com 2. 69% include a remotely loaded web analytics solution 3. 97% load something remotely If you can attack any of these you get access to a very large numbe…

Post by swombat » Thu, Sep 01, 2011, 2:08 PM UTC

simonw wrote: post #35

swombat wrote: post #34

I know that security through obscurity is no security at all, but I don't think it's particularly clever or helpful to give direct, useful advice to the goons in Iran. This is not an anonymous argument. If you were sitting next to me, I'd be, right now, arguing that you should not publish this article because it will only cause harm overall. What's next? "Why terrorists are stupid and what they should do to cause max…

If they're smart enough to forge SSL certificates, they're certainly smart enough to know about XSS.

Post by ams6110 » Thu, Sep 01, 2011, 2:38 PM UTC

Iv wrote: post #21

I use NoScript. google-analytics is never activated.