full-disclosure-uk August 2008 archive
Main Archive Page > Month Archives  > full-disclosure-uk archives
full-disclosure-uk: Re: [Full-disclosure] [OpenID] OpenID/Debian

Re: [Full-disclosure] [OpenID] OpenID/Debian PRNG/DNS Cache poisoning advisory

From: Gerald Beuchelt <beuchelt_at_nospam>
Date: Fri Aug 08 2008 - 17:44:07 GMT
To: Dick Hardt <dick@sxip.com>

Dick Hardt wrote:
> On 8-Aug-08, at 10:11 AM, Ben Laurie wrote:
>> It also only fixes this single type of key compromise. Surely it is
>> time to stop ignoring CRLs before something more serious goes wrong?
> Clearly many implementors have chosen to *knowingly* ignore CRLs
> despite the security implications, so my take away would be that the
> current public key infrastructure is flawed.

    Well, they might have done this *knowingly*, but--at least for some--I doubt that they *know* what they have done. IMO, it is bad practice to implement only half of a protocol/standard for any reason (especially out of laziness or ignorance), but that is what using certificates without CRL checking amounts to.

    If we believe that the current PKI was truly flawed, it would be an act of gross negligence to use it for anything requiring a properly secured communication channel.

    To extend Ben's advice: Decide if you want to use the current PKI. If so, implement CRL checking.

> -- Dick
> _______________________________________________
> general mailing list
> general@openid.net
> http://openid.net/mailman/listinfo/general

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/