Bugtraq mailing list archives
Re: OpenID/Debian PRNG/DNS Cache poisoning advisory
From: Eric Rescorla <ekr () networkresonance com>
Date: Fri, 08 Aug 2008 08:06:25 -0700
At Fri, 8 Aug 2008 11:50:59 +0100, Ben Laurie wrote:
However, since the CRLs will almost certainly not be checked, this means the site will still be vulnerable to attack for the lifetime of the certificate (and perhaps beyond, depending on user behaviour). Note that shutting down the site DOES NOT prevent the attack. Therefore mitigation falls to other parties. 1. Browsers must check CRLs by default.
Isn't this a good argument for blacklisting the keys on the client side? -Ekr
Current thread:
- OpenID/Debian PRNG/DNS Cache poisoning advisory Ben Laurie (Aug 08)
- <Possible follow-ups>
- Re: OpenID/Debian PRNG/DNS Cache poisoning advisory Eric Rescorla (Aug 08)
- RE: OpenID/Debian PRNG/DNS Cache poisoning advisory Dave Korn (Aug 08)
- Re: OpenID/Debian PRNG/DNS Cache poisoning advisory Eric Rescorla (Aug 08)
- Re: OpenID/Debian PRNG/DNS Cache poisoning advisory Ben Laurie (Aug 08)
- Re: [OpenID] OpenID/Debian PRNG/DNS Cache poisoning advisory Dick Hardt (Aug 08)
- Re: OpenID/Debian PRNG/DNS Cache poisoning advisory Perry E. Metzger (Aug 08)
- Re: OpenID/Debian PRNG/DNS Cache poisoning advisory Nicolas Williams (Aug 08)
- Re: OpenID/Debian PRNG/DNS Cache poisoning advisory Paul Hoffman (Aug 08)
- Re: OpenID/Debian PRNG/DNS Cache poisoning advisory Nicolas Williams (Aug 08)
- RE: OpenID/Debian PRNG/DNS Cache poisoning advisory Dave Korn (Aug 08)
- RE: OpenID/Debian PRNG/DNS Cache poisoning advisory Dave Korn (Aug 08)
- Re: OpenID/Debian PRNG/DNS Cache poisoning advisory Peter Gutmann (Aug 08)