Iran forged the wrong SSL certificate
daemonology.net
Iran forged the wrong SSL certificate
1–10 of 115 posts
Re: Iran forged the wrong SSL certificate
#2Paging tptacek, please come to the white courtesy phone and explain that SSL is the greatest thing since sliced bread. ;-)
Re: Iran forged the wrong SSL certificate
#3Slightly offtopic. can anyone explain how DigiNotar revoking the wrong certificate works?
As per my understanding the browser simply trusts all certificates issued by a trusted issuing authority, so how would you revoke a single certificate?
Re: Iran forged the wrong SSL certificate
#4Slightly offtopic. can anyone explain how DigiNotar revoking the wrong certificate works? As per my understanding the browser simply trusts all certificates issued by a trusted issuing authority, so how would you revoke a single certificate?
Revoking a certificate works as follows:
1. You add the certificate to your Certificate Revocation List.
2. You pretend that people will check the CRL before trusting the forged certificate, ignoring the fact that some clients only check for updates to the CRL periodically and most don't check CRLs at all.
In short, it doesn't really work.
Re: Iran forged the wrong SSL certificate
#5How come it's just one CA that is needed to ensure the trust of a domain, especially one as important as *.google.com? It seems like it's only a matter of time before something like this happens again.
Re: Iran forged the wrong SSL certificate
#6How come it's just one CA that is needed to ensure the trust of a domain, especially one as important as *.google.com? It seems like it's only a matter of time before something like this happens again.
[deleted]
Re: Iran forged the wrong SSL certificate
#7Slightly offtopic. can anyone explain how DigiNotar revoking the wrong certificate works? As per my understanding the browser simply trusts all certificates issued by a trusted issuing authority, so how would you revoke a single certificate?
Revoking a certificate works as follows: 1. You add the certificate to your Certificate Revocation List. 2. You pretend that people will check the CRL before trusting the forged certificate, ignoring the fact that some clients only check for updates to the CRL periodically and most don't check CRLs at all. In short, it doesn't really work.
Re: Iran forged the wrong SSL certificate
#8How come it's just one CA that is needed to ensure the trust of a domain, especially one as important as *.google.com? It seems like it's only a matter of time before something like this happens again.
[deleted]
Re: Iran forged the wrong SSL certificate
#9Does this apply to ad networks as well?
Re: Iran forged the wrong SSL certificate
#10Does this apply to ad networks as well?
Depends how you insert the ad code into your website; but probably, yes.