News for hackers. Stuff that matters.

A comment on The Definitive Guide To Website Authentication. Parent comment

Re:The Definitive Guide To Website Authentication by JVerstry on Monday August 08, 2011 @07:58AM (#2859723)
No, that is not exactly true. If you use SSL, there will be authentication. Eve-in-the-middle cannot craft certificates or feed the browser with her fake certificates. No 3rd party HTML/Javascript/whatever code can change this. So there is a higher level of security with SSL.
[ Parent | on HN ]
Re:The Definitive Guide To Website Authentication by rjbond3rd on Monday August 08, 2011 @09:01AM (#2859886)
Definitely true but this scenario worries me:

1. Get a signed cert from a recognized CA (fraudulently - not impossible).

2. Hijack the DNS (e.g., get their GoDaddy password, or point them to a DNS server you control)>.

3. The user is directed to the fake server with the fraudulently obtained cert, and does not receive a warning.

[ Parent | on HN ]
Re:The Definitive Guide To Website Authentication by JVerstry on Monday August 08, 2011 @09:19AM (#2859941)
Absolutely, authentication is not bullet-proof. That's why certificate authorities have to invalidate certificates from time-to-time.
[ Parent | on HN ]
Re:The Definitive Guide To Website Authentication by rjbond3rd on Monday August 08, 2011 @10:05AM (#2860090)
True, and of course they can only revoke the ones they know are fake. And the browser/client has to respect the revocation list.
[ Parent | on HN ]
Re:The Definitive Guide To Website Authentication by yread on Monday August 08, 2011 @08:51AM (#2859856)
that's what I'm trying to say, too. I meant that you're not safe even with DH and have to use SSL
[ Parent | on HN ]