Re: [Full-disclosure] HTTP AUTH BASIC monowall

On Wed, 15 Mar 2006 15:14:47 EST, Brian Eaton said:
tim-security at sentinelchicken.org wrote:

How trustworthy are the CA certificates included in the average browser?

There are a couple of dozen CA certificates shipped with my browser.
Some of the vendors associated with these CA certificates offer to
give me a certificate for my web site in 10 minutes or less for a
couple of hundred dollars.

This sounds like a really ripe opportunity for social engineering to me.

Been there, done that already. There was a phishing run a while ago,
the guys even had a functional SSL cert for www.mountain-america.net (the
actual bank was mntamerica.net or something like that..)

Only real solution there is to get a good grip on what a CA is actually
certifying, which is a certain (usually very minimal) level of
*authentication*. They're certifying that somebody convinced them that the cert
was for who they claimed it was for. That's it. Anybody who attaches any
*other* meaning to it is making a big mistake. In particular, "authorization"
is totally out-of-scope here....

"You are now talking to the site that one of the CAs you trust thinks belongs
to Frobozz, Inc.".

If you don't trust that CA's judgment, you better heave their root cert overboard...

Attachment: pgpRC0thK3ccC.pgp
Description: PGP signature

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Relevant Pages

  • Re: SSL and Client Authentication
    ... First I go on my client and I do a browser request from a CA, ... After issuing a cert. ... install (where I verify that this certification was installed ... > It definitely does not sound like the right way to do client certificates. ...
    (microsoft.public.inetserver.iis.security)
  • Re: Its Either Gonna Be
    ... Nope, stupid certificates like the Microsoft certifications, PMI, ... I worked for Oracle as a senior DBA consultant for four years. ... with a cert. ... She's working as a manager of program managers and managers about 15 to ...
    (rec.sport.football.college)
  • Re: cert authority
    ... Open the certificates console for your user and check Trusted Root ... Now that I moved it into my 2k AD, it doesn't seem to trust the cert. ...
    (microsoft.public.win2000.active_directory)
  • Re: Error issuing certificates from WS03 cert svc
    ... Your problem was the removal of the revoked certificates. ... The revocation function was unable to ... The request was for <here comes specific cert subject info>. ... All certs are likewise published on the web server ...
    (microsoft.public.windows.server.security)
  • Re: User certificate question (no AD installed)
    ... > We are able to use the VPN with computer certificates without problems, ... When opening the page to request a certificate, ... web browser cert, e-mail cert and adv cert request. ... environments involves AD and ISA server. ...
    (microsoft.public.win2000.networking)