Bugtraq mailing list archives
RE: OpenID/Debian PRNG/DNS Cache poisoning advisory
From: "Clausen, Martin (DK - Copenhagen)" <mclausen () deloitte dk>
Date: Tue, 12 Aug 2008 10:55:53 +0200
You could use the SSL Blacklist plugin (http://codefromthe70s.org/sslblacklist.asp) for Firefox or heise SSL Guardian (http://www.heise-online.co.uk/security/Heise-SSL-Guardian--/features/11 1039/) for IE to do this. If presented with a Debian key the show a warning. The blacklists are implemented using either a traditional blacklist (text file) or distributed using DNS. ~martin -----Original Message----- From: owner-cryptography () metzdowd com [mailto:owner-cryptography () metzdowd com] On Behalf Of Eric Rescorla Sent: 8. august 2008 17:06 To: Ben Laurie Cc: bugtraq () securityfocus com; security () openid net; OpenID List; cryptography () metzdowd com; full-disclosure () lists grok org uk Subject: Re: OpenID/Debian PRNG/DNS Cache poisoning advisory At Fri, 8 Aug 2008 11:50:59 +0100, Ben Laurie wrote:
However, since the CRLs will almost certainly not be checked, this means the site will still be vulnerable to attack for the lifetime of the certificate (and perhaps beyond, depending on user behaviour). Note that shutting down the site DOES NOT prevent the attack. Therefore mitigation falls to other parties. 1. Browsers must check CRLs by default.
Isn't this a good argument for blacklisting the keys on the client side? -Ekr --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo () metzdowd com ---------------------- Deloitte Disclaimer --------------------- This message (including any attachments) contains confidential information intended for a specific individual and purpose, and is protected by law. If you are not the intended recipient, you should delete this message and are hereby notified that any disclosure, copying, or distribution of this message, or the taking of any action based on it, is strictly prohibited. ----------------------------------------------------------------
Current thread:
- Re: OpenID/Debian PRNG/DNS Cache poisoning advisory, (continued)
- Re: OpenID/Debian PRNG/DNS Cache poisoning advisory Leichter, Jerry (Aug 08)
- Re: OpenID/Debian PRNG/DNS Cache poisoning advisory Eric Rescorla (Aug 08)
- Re: OpenID/Debian PRNG/DNS Cache poisoning advisory Forrest J. Cavalier III (Aug 12)
- Re: OpenID/Debian PRNG/DNS Cache poisoning advisory Leichter, Jerry (Aug 12)
- key blacklisting & file size (was: OpenID/Debian PRNG/DNS Cache poisoning advisory) Solar Designer (Aug 08)
- Re: OpenID/Debian PRNG/DNS Cache poisoning advisory Florian Weimer (Aug 12)
- Message not available
- Re: OpenID/Debian PRNG/DNS Cache poisoning advisory Ben Laurie (Aug 08)
- Re: OpenID/Debian PRNG/DNS Cache poisoning advisory Stefan Kanthak (Aug 12)
- Re: OpenID/Debian PRNG/DNS Cache poisoning advisory Tim Dierks (Aug 12)
- RE: OpenID/Debian PRNG/DNS Cache poisoning advisory Leichter, Jerry (Aug 08)
- Re: OpenID/Debian PRNG/DNS Cache poisoning advisory Ben Laurie (Aug 12)
- Re: OpenID/Debian PRNG/DNS Cache poisoning advisory Ben Laurie (Aug 12)
- Re: OpenID/Debian PRNG/DNS Cache poisoning advisory Ben Laurie (Aug 12)