21–30 of 155 posts
Love to see a post on how it was done and the tools he used.
EDIT He won't reveal it for a week. Good on him. https://twitter.com/indutny/status/454790640078176256
Earlier quoted context omitted.
Putting that mapping in /etc/hosts lets your machine skip DNS lookup for that hostname, and just use his IP for that domain name. Then, your browser checks the received certificate against the authenticated TLS connection, and sees that all is well, allowing you to connect without a warning. Since the browser does not warn of a certificate mismatch, he must have a valid certificate for 'cloudflarechallenge.com'. QED.
But seems like only the http connection is working, i get a warning in Chrome when visiting https://cloudflarechallenge.com . Isn't that the only situation where the key would be checked. That's the part that doesn't make sense.
Earlier quoted context omitted.
Putting that mapping in /etc/hosts lets your machine skip DNS lookup for that hostname, and just use his IP for that domain name. Then, your browser checks the received certificate against the authenticated TLS connection, and sees that all is well, allowing you to connect without a warning. Since the browser does not warn of a certificate mismatch, he must have a valid certificate for 'cloudflarechallenge.com'. QED.
But seems like only the http connection is working, i get a warning in Chrome when visiting https://cloudflarechallenge.com . Isn't that the only situation where the key would be checked. That's the part that doesn't make sense.
Either go to https://www.cloudflarechallenge.com or remove the www subdomain from your hosts entry.
Earlier quoted context omitted.
Putting that mapping in /etc/hosts lets your machine skip DNS lookup for that hostname, and just use his IP for that domain name. Then, your browser checks the received certificate against the authenticated TLS connection, and sees that all is well, allowing you to connect without a warning. Since the browser does not warn of a certificate mismatch, he must have a valid certificate for 'cloudflarechallenge.com'. QED.
But seems like only the http connection is working, i get a warning in Chrome when visiting https://cloudflarechallenge.com . Isn't that the only situation where the key would be checked. That's the part that doesn't make sense.
I see Indutny's blog for 'https://www.cloudflarechallenge.com'[/etc/hosts mapped to 165.225.128.15] in both FF and Chrome.
We have reached out via twitter to this invidiual as to coordinate the delivery of the $10,000 bounty we offered. If anyone is already in contact with them please direct them to https://news.ycombinator.com/item?id=7572530
We have reached out via twitter to this invidiual as to coordinate the delivery of the $10,000 bounty we offered. If anyone is already in contact with them please direct them to https://news.ycombinator.com/item?id=7572530
Somehow I totally missed your bounty offer. Not that I was going to win if I had seen it, but where was it mentioned?
https://twitter.com/indutny/status/454767565991325697 How do you not love this guy.
Me? Insane jealousy.
(Although I do like that he made me google up the X-Men And Teen Titans cover art to confirm the source of his Twitter pic.)
Bravo to indutny for pulling it off in 3 hours.
Earlier quoted context omitted.
On the other hand, if anyone asks me to justify all that "unproductive time" this week, I don't need to handwave and explanations any more.
I was lucky, my boss understood pretty quickly how big a deal it was. My project manager didn't, though, but he did pretty quick when I cracked our dev server and told him his password for a couple of services. It was fun playing pen tester and getting paid for it this week :)
If you only change your current cert to get a new key but you don't go through the revocation process of the old certificate if someone managed to get the old one they can still use it for a MiTM attack - as both certs would be valid to any client.