User: Password:
|
|
Subscribe / Log in / New account

SSL certificates and MD5 collisions

SSL certificates and MD5 collisions

Posted Jan 15, 2009 19:02 UTC (Thu) by bronson (subscriber, #4806)
In reply to: SSL certificates and MD5 collisions by HenrikH
Parent article: SSL certificates and MD5 collisions

Ya, great. Now a simple DNS spoof/poisoning can replace all your browser certs with evil ones.

Beware the cure that's worse than the disease.


(Log in to post comments)

SSL certificates and MD5 collisions

Posted Jan 15, 2009 20:54 UTC (Thu) by HenrikH (subscriber, #31152) [Link]

Exactly how could your scenario replace my browser certs with evil ones when all my proposal does is to add an extra layer of verification (that the certificate has been changed since my last visit) ?

SSL certificates and MD5 collisions

Posted Jan 17, 2009 19:55 UTC (Sat) by bronson (subscriber, #4806) [Link]

Sorry, I misread your suggestion. I thought you were suggesting a CRL-like behavior. If you're just talking about adding an SSH-like warning, and not manipulating or revoking the certificates on the browser itself, then I take back what I said.

Of course, the SSH warning has been shown to be fairly ineffective in the real world. And that's with sysadmins who should know better! What about regular people? When presented a dialog box saying "The certificate for Chase Bailout Bank has changed! Do you want to continue?" I would guess that 99 out of 100 of them would simply click "Yes."

But, I agree, it wouldn't hurt.

SSL certificates and MD5 collisions

Posted Jan 20, 2009 9:33 UTC (Tue) by HenrikH (subscriber, #31152) [Link]

That is exactly my suggestion, to add a SSH-like warning. Agreed that not many people would benefit from it, but I know that I would :-)


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds