| Main Archive Page > Month Archives > full-disclosure-uk archives |
[Full-disclosure] The merits and uses of CAs
From: Christopher Pritchard <mailinglist_at_nospam>Date: Mon Jan 05 2009 - 23:55:59 GMT
To: <Valdis.Kletnieks@vt.edu>, "'Tim'" <tim-security@sentinelchicken.org>
>I believe I stated *up front* that it doesn't secure against an active MITM
attack. Once ettercap presents a *different* >certificate than the one you
were expecting, the victim can at least potentially notice (the same way
that OpenSSH complains >if it discovers that a host key is different).
I think that using a self signed certificate should be OK and not throw up any warnings, however it should not change the colour of the address bar (as using valid certificates does in many modern browsers). I also feel that if the certificate changes (a la SSH), it should throw up a warning, unless the previous certificate became invalid (for example due to a date issue). It should also be possible to have semi-centralised CRLs that browsers would check for occasions when the server admin wants to change certificates, they could post the old one up on the list and the browser wouldn't warn when a new certificate is presented. HTTPS is more secure than HTTP in all instances, we should not discourage the use of self signed certificates, however we also should not portray them as more secure than they actually are (which is protection against PASSIVE snooping), and things that require proper security should use either properly signed (by a CA) certs or EV ones.
Chris
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/