Re: HTTP AUTH BASIC monowall

[Valdis.Kletnieks () vt edu]

On Wed, 15 Mar 2006 15:14:47 EST, Brian Eaton said:
> tim-security at sentinelchicken.org wrote:

> How trustworthy are the CA certificates included in the average browser?
>
> There are a couple of dozen CA certificates shipped with my browser.
> Some of the vendors associated with these CA certificates offer to
> give me a certificate for my web site in 10 minutes or less for a
> couple of hundred dollars.
>
> This sounds like a really ripe opportunity for social engineering to me.

Been there, done that already.  There was a phishing run a while ago,
the guys even had a functional SSL cert for www.mountain-america.net (the
actual bank was mntamerica.net or something like that..)

Only real solution there is to get a good grip on what a CA is actually
certifying, which is a certain (usually very minimal) level of
*authentication*. They're certifying that somebody convinced them that the cert
was for who they claimed it was for.  That's it.  Anybody who attaches any
*other* meaning to it is making a big mistake.  In particular, "authorization"
is totally out-of-scope here....

"You are now talking to the site that one of the CAs you trust thinks belongs
to Frobozz, Inc.".

If you don't trust that CA's judgment, you better heave their root cert overboard...

Attachment: _bin
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/