Alaric, You didn't start a new thread. Your message was still a reply to another message and so is reckoned to be part of that other thread.
As for your claims, this is getting silly. In your lab setup, you are the rightful owner of the servers, and you are the attacker. If you, as the rightful owner of the site, choose to put your cert and private key on multiple hosts, so that any of them may claim to have some DNS name, then you are making the statement true. By your act, as the rightful owner of the cert and the server on which it belongs, of putting the cert on another server, you are stating that the server on which you put it is actually your server, and rightfully serves that DNS name. So, when the browser confirms that, it is not an attack succeeding. Another way to view your setup is that you are both the rightful site owner and the attacker. You (as site owner) are acting in collusion with the attacker. By putting your cert and private key on another system with another IP address, a system to which the attacker will redirect traffic for that DNS name by means of DNS server alteration, you are colluding with the attacker. You could do such collusion in many ways, including simply sending the attacker a copy of everything you receive and send. When the attacker operates in collusion with the rightful owner, he is acting with that owner's authority, and in delivering traffic to him, SSL is delivering it to a site authorized to answer to that DNS host name by the rightful owner of that host. In delivering the data, without error or warning to the server to which you (rightful owner) have transferred the cert and private key, SSL is in fact still delivering the data to the site which the rightful cert owner has designated as the (or a) correct server for that DNS name. So, it is not a successful attack for it to do so. The "attack" doesn't succeed without the collusion of the rightful cert owner. By colluding with the attacker, the rightful cert owner effectively extends the rightful use of his cert to include the attacker's uses. Thus the attacker ceases to be an attacker, and instead becomes an agent of the rightful owner. This is all meaningless in terms of detecting attacks from attackers who are not colluding with the rightful cert holders. Now, enough. _______________________________________________ dev-security mailing list [email protected] https://lists.mozilla.org/listinfo/dev-security
