Comments: DNS rebinding attack/patch: the germination of professional security cooperation?

Off-topic-ish...

Now that $10 at GoDaddy buys a certificate, how safe is SSL anyway?

Hypothetical thought: Visa issues a USB Smart Card with it's own trusted CA root for website certs that it's member (customer or whatever it is now) banks have issued. There are then usage restrictions on the card's private key, so it can only be used on those sites.

Posted by Thomas Barker at July 10, 2008 07:53 PM

Still off-topic, but this is my pet peeve...

>Now that $10 at GoDaddy buys a certificate, how safe is SSL anyway?
Not very. This is what disgusts me about the whole x.509 PKI system.

There are some 100 root certs installed by default in my browser, some owned by companies I've never heard of, and I'm supposed to trust every one of them.

And when has a certificate ever meant more than that its holder possessed a valid credit card and spent $X on it? The x.509 system is more of a money-making scheme implemented as a private tax on e-commerce than anything else. Is any certificate authority going to do any more checking of your identity than necessary to charge your credit card before they issue you a cert? I think not. They might look up who you are a little more if you want one of those Extended Validation certs, but I really doubt they are going to trek down to the courthouse to verify your business's incorporation documents before issuing you a pretty green cert. After all, they wouldn't want to lose a potential sale on a $300+ cert by checking somebody out TOO carefully.

And really, it is far beyond the scope of any certificate authority to make a judgment as to whether or not you should trust a particular company with your credit card details. Not even the BBB is any good for that.

So, back on topic, we are still dependent on basic DNS security, common sense, and a healthy dose of skepticism online.

Posted by anon at July 10, 2008 10:24 PM

"It is ridiculous but it's no more ridiculous than the way a lot of people cling to failed ideas. Keynes said "It's not bringing in the new ideas that's so hard. It's getting rid of the old ones." And Einstein said it better, attributing his mental success to "curiosity, concentration, perseverance and self-criticism." By self-criticism he meant becoming good at destroying your own best-loved and hardest-won ideas. If you can get really good at destroying your own wrong ideas, that is a great gift."
-Charlie Munger

Posted by Gunnar at July 11, 2008 07:38 AM

X.509 isn't about trust, it's about the level of confidence that people are telling the truth/acting in good faith. Trust is fluid and changes all the time it certainly isn't black or white and certainly isn't told to us by faceless multinational corps. well regretably there is sheeple I suppose.

However back to trust, would you trust someone you just met with your car keys/child because they had a X.509 cert signed by verisign?

In any case we don't need X.509, OpenPGP works just fine in exactly the same manner, now if only there were some other people capable of helping me code web browser plugins I'm sure we'd all be better off.

As for DNS

http://www.ietf.org/internet-drafts/draft-groth-dns-encryption-02.txt
http://www.ietf.org/internet-drafts/draft-groth-dns-encryption-02.pdf

Posted by Duane at July 15, 2008 01:41 AM
Post a comment









Remember personal info?






Hit Preview to see your comment.
MT::App::Comments=HASH(0x5562b61ffc40) Subroutine MT::Blog::SUPER::site_url redefined at /home/iang/www/fc/cgi-bin/mt/lib/MT/Object.pm line 125.