From: Gregory Maxwell <gmaxwell@gmail•com>
To: Drak <drak@zikula•org>
Cc: Bitcoin Dev <bitcoin-development@lists•sourceforge.net>
Subject: Re: [Bitcoin-development] Dedicated server for bitcoin.org, your thoughts?
Date: Sun, 8 Dec 2013 12:50:29 -0800 [thread overview]
Message-ID: <CAAS2fgT=0m=0-C+MNotUy6nqwcR-Y+YTNYrS8DZptMo5vCMRnA@mail.gmail.com> (raw)
In-Reply-To: <CANAnSg2tep2VURmudfNModuJAryw8hfOj8Z8idVbt37keiZ8Lg@mail.gmail.com>
On Sun, Dec 8, 2013 at 12:40 PM, Drak <drak@zikula•org> wrote:
> Let me clarify. SSL renders BGP redirection useless because the browser
> holds the signatures of CA's it trusts: an attacker cannot spoof a
> certificate because it needs to be signed by a trusted CA: that's the point
> of SSL, it encrypts and proves identity, the latter part is what thwarts
> MITM. If there was an MITM the browser screams pretty loudly about it with a
> big threat warning interstitial.
Sadly this isn't true: There are (many) CAs which will issue a
certificate (apparently sometime within minutes, though last
certificate I obtained took a couple hours total) to anyone who can
respond to http (not https) requests on behalf of the domain from the
perspective of the CA.
This means you can MITM the site, pass all traffic through except the
HTTP request from the CA, and start intercepting once the CA has
signed your certificate. This works because the CA does nothing to
verify identity except check that the requester can control the site.
If you'd like to me to demonstrate this attack for you I'd be willing—
I can provide a proxy that passes on :80 and :443, run your traffic
through it and I'll get a cert with your domain name.
I'm sorry for the tangent here— I think this sub-discussion is really
unrelated to having Bitcoin.org behind SSL— but "someone is wrong on
the internet", and its important to know that SSL hardly does anything
to reduce the need to check the offline signatures on the binaries.
next prev parent reply other threads:[~2013-12-08 20:50 UTC|newest]
Thread overview: 56+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-12-08 1:17 Saïvann Carignan
2013-12-08 3:38 ` Odinn Cyberguerrilla
2013-12-08 9:03 ` Saïvann Carignan
2013-12-08 12:37 ` Luke-Jr
2013-12-08 19:16 ` Drak
2013-12-08 19:25 ` Gregory Maxwell
2013-12-08 20:28 ` Mike Hearn
2013-12-08 20:40 ` Gregory Maxwell
2013-12-08 20:51 ` Drak
2013-12-08 21:01 ` Luke-Jr
2013-12-08 21:11 ` Drak
2013-12-08 23:51 ` theymos
2013-12-09 0:06 ` Taylor Gerring
2013-12-09 6:29 ` Jeremy Spilman
2013-12-09 10:54 ` Roy Badami
2013-12-10 9:18 ` Odinn Cyberguerrilla
2013-12-08 21:09 ` Gregory Maxwell
2013-12-08 21:16 ` Saïvann Carignan
2013-12-08 21:58 ` Roy Badami
2013-12-08 23:03 ` Mike Hearn
2013-12-09 5:32 ` Jeff Garzik
2013-12-08 22:44 ` Gavin Andresen
2013-12-08 23:48 ` Saïvann Carignan
2013-12-08 23:18 ` Luke-Jr
2013-12-08 23:29 ` Patrick
2013-12-08 21:46 ` Mark Friedenbach
2013-12-08 20:40 ` Drak
2013-12-08 20:50 ` Gregory Maxwell [this message]
2013-12-08 21:07 ` Drak
2013-12-08 21:14 ` Gregory Maxwell
2013-12-08 22:27 ` Robert McKay
2013-12-12 20:51 ` Adam Back
2013-12-31 13:39 ` Drak
2013-12-31 13:48 ` Gregory Maxwell
2013-12-31 13:59 ` Mike Hearn
2013-12-31 14:18 ` Gregory Maxwell
2013-12-31 14:23 ` Mike Hearn
2013-12-31 21:25 ` Jeremy Spilman
2013-12-31 21:33 ` Matt Corallo
2014-01-01 10:02 ` Jeremy Spilman
2014-01-01 11:37 ` Wladimir
2014-01-01 15:10 ` Mike Hearn
2014-01-01 22:15 ` Mike Hearn
2014-01-02 19:49 ` Jorge Timón
2013-12-31 14:05 ` Benjamin Cordes
2014-01-03 5:45 ` Troy Benjegerdes
2014-01-03 9:59 ` Drak
2014-01-03 11:22 ` Tier Nolan
2014-01-03 13:09 ` Adam Back
2014-01-03 17:38 ` Troy Benjegerdes
2014-01-03 18:21 ` Jorge Timón
2014-01-04 1:43 ` Troy Benjegerdes
2013-12-08 10:00 ` Drak
2013-12-08 12:39 ` Luke-Jr
2013-12-08 16:51 ` Gregory Maxwell
2013-12-08 16:08 ` Wladimir
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAAS2fgT=0m=0-C+MNotUy6nqwcR-Y+YTNYrS8DZptMo5vCMRnA@mail.gmail.com' \
--to=gmaxwell@gmail$(echo .)com \
--cc=bitcoin-development@lists$(echo .)sourceforge.net \
--cc=drak@zikula$(echo .)org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox