Re: [Full-disclosure] HTTP AUTH BASIC monowall

How trustworthy are the CA certificates included in the average browser?

Ah, well, that's another good topic of discussion, though I'm sure it
will just start a new thread of flames.

There are a couple of dozen CA certificates shipped with my browser.
Some of the vendors associated with these CA certificates offer to
give me a certificate for my web site in 10 minutes or less for a
couple of hundred dollars.

This sounds like a really ripe opportunity for social engineering to me.


Yes, I really don't trust the all-or-nothing SSL PKI myself. If any
*one* CA certificate in your list is compromised, all SSL connections
you make from your browser could be compromised. There's no way to say
"I trust this CA more than others", or to say you trust a given CA only
for certain domains (afaik). It is also very centralized, which makes
it convenient for abuse by monopolies.

I haven't looked into it a whole lot, but does anyone know of
alternatives or ways of establishing webs of trust with SSL/TLS?

tim

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages

  • Re: how can you verify that the site you get is not a fake?
    ... > Web Site Identity Verified ... a certificate authority you trust for this purpose. ... by using a main frame protected via HTTP/S and a valid SSL ...
    (Fedora)
  • Re: How can I act as a Certificate Authority (CA) with openssl ??
    ... > To become a CA you need to 'register' yourself as a CA by submitting ... least) stopping me signing a digital certificate, ... then putting that on a web site. ... whether a third party chooses to trust me is entirely up to them. ...
    (sci.crypt)
  • Re: How can I act as a Certificate Authority (CA) with openssl ??
    ... > To become a CA you need to 'register' yourself as a CA by submitting ... least) stopping me signing a digital certificate, ... then putting that on a web site. ... whether a third party chooses to trust me is entirely up to them. ...
    (comp.security.unix)
  • Re: https security alert / certificates
    ... This Security Certificate Was Issued by a Company that You ... Have Not Chosen to Trust ... The web content is in a virtual directory Web Sites> Default Web Site> ariesystest. ...
    (microsoft.public.inetserver.iis.security)
  • Re: Proposal for a new PKI model (At least I hope its new)
    ... That is say I trust Paul Rubin's public key. ... two basic reasons for the SSL server domain name certificate: ... certificates have to check with the domain name infrastructure to see ... CA/PKI industry is that public keys be registered with the domain name ...
    (sci.crypt)