News for hackers. Stuff that matters.

A comment on The Definitive Guide To Website Authentication. Parent comment

Re:The Definitive Guide To Website Authentication by rjbond3rd on Monday August 08, 2011 @09:01AM (#2859886)
Definitely true but this scenario worries me:

1. Get a signed cert from a recognized CA (fraudulently - not impossible).

2. Hijack the DNS (e.g., get their GoDaddy password, or point them to a DNS server you control)>.

3. The user is directed to the fake server with the fraudulently obtained cert, and does not receive a warning.

[ Parent | on HN ]
Re:The Definitive Guide To Website Authentication by JVerstry on Monday August 08, 2011 @09:19AM (#2859941)
Absolutely, authentication is not bullet-proof. That's why certificate authorities have to invalidate certificates from time-to-time.
[ Parent | on HN ]
Re:The Definitive Guide To Website Authentication by rjbond3rd on Monday August 08, 2011 @10:05AM (#2860090)
True, and of course they can only revoke the ones they know are fake. And the browser/client has to respect the revocation list.
[ Parent | on HN ]