RE: OpenID/Debian PRNG/DNS Cache poisoning advisory

2008-08-12 Thread Clausen, Martin (DK - Copenhagen)
You could use the SSL Blacklist plugin
(http://codefromthe70s.org/sslblacklist.asp) for Firefox or heise SSL
Guardian
(http://www.heise-online.co.uk/security/Heise-SSL-Guardian--/features/11
1039/) for IE to do this. If presented with a Debian key the show a
warning.

The blacklists are implemented using either a traditional blacklist
(text file) or distributed using DNS.

~~martin

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Eric Rescorla
Sent: 8. august 2008 17:06
To: Ben Laurie
Cc: [EMAIL PROTECTED]; [EMAIL PROTECTED]; OpenID List;
cryptography@metzdowd.com; [EMAIL PROTECTED]
Subject: Re: OpenID/Debian PRNG/DNS Cache poisoning advisory

At Fri, 8 Aug 2008 11:50:59 +0100,
Ben Laurie wrote:
 However, since the CRLs will almost certainly not be checked, this 
 means the site will still be vulnerable to attack for the lifetime of 
 the certificate (and perhaps beyond, depending on user behaviour). 
 Note that shutting down the site DOES NOT prevent the attack.
 
 Therefore mitigation falls to other parties.
 
 1. Browsers must check CRLs by default.

Isn't this a good argument for blacklisting the keys on the client side?

-Ekr

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to
[EMAIL PROTECTED]
-- Deloitte Disclaimer -
This message (including any attachments) contains confidential
information intended for a specific individual and purpose, and
is protected by law. If you are not the intended recipient, you
should delete this message and are hereby notified that any
disclosure, copying, or distribution of this message, or the
taking of any action based on it, is strictly prohibited.
 

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]


Re: OpenID/Debian PRNG/DNS Cache poisoning advisory

2008-08-12 Thread Ben Laurie
On Tue, Aug 12, 2008 at 9:55 AM, Clausen, Martin (DK - Copenhagen)
[EMAIL PROTECTED] wrote:
 You could use the SSL Blacklist plugin
 (http://codefromthe70s.org/sslblacklist.asp) for Firefox or heise SSL
 Guardian
 (http://www.heise-online.co.uk/security/Heise-SSL-Guardian--/features/11
 1039/) for IE to do this. If presented with a Debian key the show a
 warning.

 The blacklists are implemented using either a traditional blacklist
 (text file) or distributed using DNS.

There are two parties that are vulnerable: the user logging into the
OpenID Provider (OP), and the Relying Party (RP). If the RP
communicates with the OP, then it needs to use TLS and CRLs or OCSP.
Browser plugins do not bail it out.

Cheers,

Ben.

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]


ADMIN: Why no HTML?

2008-08-12 Thread Perry E. Metzger

A couple of people have asked me why I have a policy against
forwarding HTML email. Here is the rationale, roughly from most
to least important.

1) Many people still read their email in systems that handle only
   plain text effectively. They're a large enough group that I don't
   like disenfranchising them.*
2) HTML email, like most machine parsable data, often has gotchas,
   and as this is a security oriented list, I really don't want to
   have to vet email for hacking attempts. Vetting real code is
   unpleasant enough -- I don't want to have to look for attempted
   buffer overflows and web bugs in email I'm forwarding.
3) HTML email is harder to search, to edit down, to cut and paste
   cleanly, etc.
4) HTML email is often just plain ugly to look at.

Perhaps someday I'll change my mind, but for the moment, please send
only in plain text.

In the same vein, keep in mind that although Microsoft Outlook won't
show you that your lines are run on and include proprietary Microsoft
characters for balanced quotes and such, for the sake of the rest of
us, hit carriage return every 60 or 70 characters and don't send in
proprietary character sets.

Perry
-- 
Perry E. Metzger[EMAIL PROTECTED]

(* I'm one of the group that reads email in a non-GUI. Please don't
tell me to switch mail readers, because I've yet to find a GUI based
one that will let me process hundreds to thousands of incoming emails
a day efficiently, and without efficiency I'd stop getting any work
done. Pretty toys are great if you're reading 20 messages a day and
can't remember commands -- I need stuff that's fully programmable.)

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to [EMAIL PROTECTED]