User: Password:
|
|
Subscribe / Log in / New account

Cryptographic splicing makes for a Wordpress vulnerability

Cryptographic splicing makes for a Wordpress vulnerability

Posted May 16, 2008 12:30 UTC (Fri) by robbe (subscriber, #16131)
In reply to: Cryptographic splicing makes for a Wordpress vulnerability by jschrod
Parent article: Cryptographic splicing makes for a Wordpress vulnerability

> Automatic certificate selection doesn't work then, as no realm concept
as in baseauth exists.

That's not true. If a server requests a client certificate, it has to 
send a list of "acceptable" CAs. The client is supposed to use a cert 
that is signed by one of those. If you plan your environment carefully 
automatic selection can work (except for IE which apparently is too dumb 
to heed the acceptable CA list and always shows all certificates to to 
the user).

I agree with most of your other points. Setting up proper 
authentification via client certificates is a complicated mess.


(Log in to post comments)


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds