The Guardian also open-sourced a test SSL cert

#1

Post by boyander » Mon, Dec 09, 2013, 4:27 PM UTC

The Guardian also open-sourced a test SSL cert
github.com

Re: The Guardian also open-sourced a test SSL cert

#2

Post by vxxzy » Mon, Dec 09, 2013, 4:39 PM UTC

This is just a self-signed cert.

Re: The Guardian also open-sourced a test SSL cert

#3

Post by anilshanbhag » Mon, Dec 09, 2013, 4:40 PM UTC

So now anyone snooping on visitors to Guardian's site can decrypt the communication. Don't see why anyone would waste time on this given that there is no 'money' involved.

Re: The Guardian also open-sourced a test SSL cert

#4

Post by ctz » Mon, Dec 09, 2013, 4:41 PM UTC

  Issuer: C=GB, ST=London, L=London, O=GU, OU=tech, CN=*.int.gnl/emailAddress=martyn.inglis@guardian.co.uk  
  Subject: C=GB, ST=London, L=London, O=GU, OU=tech, CN=*.int.gnl/emailAddress=martyn.inglis@guardian.co.uk

This isn't the Guardian's certificate. It's self-signed, for starters.

Re: The Guardian also open-sourced a test SSL cert

#5

Post by clone1018 » Mon, Dec 09, 2013, 4:41 PM UTC

Wouldn't this allow someone to do a full man in the middle attack with a compromised server/dns server?

Re: The Guardian also open-sourced a test SSL cert

#6

Post by pritambaral » Mon, Dec 09, 2013, 4:42 PM UTC

clone1018 wrote: post #5

Wouldn't this allow someone to do a full man in the middle attack with a compromised server/dns server?

If it were the actual cert they're using, yes.

Re: The Guardian also open-sourced a test SSL cert

#7

Post by untog » Mon, Dec 09, 2013, 4:42 PM UTC

vxxzy wrote: post #2

This is just a self-signed cert.

Before everyone gets hysterical, please vote ^^^ that comment up. It's a self-signed cert, it is not used in production:

https://news.ycombinator.com/item?id=6875023

Re: The Guardian also open-sourced a test SSL cert

#8

Post by [deleted] » Mon, Dec 09, 2013, 4:43 PM UTC

[deleted]

Re: The Guardian also open-sourced a test SSL cert

#9

Post by clone1018 » Mon, Dec 09, 2013, 4:44 PM UTC

pritambaral wrote: post #6

clone1018 wrote: post #5

Wouldn't this allow someone to do a full man in the middle attack with a compromised server/dns server?

If it were the actual cert they're using, yes.

Oh I see now that it's just the self signed cert. Awesome :)

Re: The Guardian also open-sourced a test SSL cert

#10

Post by bradleybuda » Mon, Dec 09, 2013, 4:44 PM UTC

untog wrote: post #7

vxxzy wrote: post #2

This is just a self-signed cert.

Before everyone gets hysterical, please vote ^^^ that comment up. It's a self-signed cert, it is not used in production: https://news.ycombinator.com/item?id=6875023

Yep. Though it opens up a (probably hypothetical) potential attack if this cert is widely trusted on, say, Guardian employees' development machines.