News for hackers. Stuff that matters.

A comment on An update on attempted man-in-the-middle attacks. Parent comment

Re:An update on attempted man-in-the-middle attacks by dekz on Tuesday August 30, 2011 @02:51AM (#2940413)
Keychain -> System Roots -> Search for DigiNotar -> Right click delete.

Assert it has been removed by navigating to https://www.diginotar.nl/

[ Parent | on HN ]
Re:An update on attempted man-in-the-middle attacks by dredmorbius on Tuesday August 30, 2011 @04:04AM (#2940535)
Is that what you really want to do?

What's to keep an OS upgrade from restoring the certificate?

A system or user-maintained blacklist seems like a more tenable solution. You don't want to delete the cert, you want to hang a scarlet letter on it. Oh, and not trust it for anything (or better, use it to blacklist any site that attempts to use it).

[ Parent | on HN ]
Re:An update on attempted man-in-the-middle attacks by eonwe on Tuesday August 30, 2011 @12:55PM (#2942213)
At least for me there's no such choice as delete in the System Roots keychain. The only thing I can do is to set it to "never trust" and still Chrome/Safari show it as trusted: http://imgur.com/NcUYf
[ Parent | on HN ]
Re:An update on attempted man-in-the-middle attacks by biafra on Tuesday August 30, 2011 @02:54AM (#2940420)
Did you try that and it really removed the CA?

Or is it supposed to remove the trust only but keep the entry?

[ Parent | on HN ]
Re:An update on attempted man-in-the-middle attacks by dekz on Tuesday August 30, 2011 @03:08AM (#2940438)
It removed the entry completely from the Keychain, I am on Lion for reference.

Sanity testing by loading the homepage over HTTPS results in a certificate warning on all browsers (Firefox redirected to HTTP).

[ Parent | on HN ]
Re:An update on attempted man-in-the-middle attacks by idlewords on Tuesday August 30, 2011 @04:38AM (#2940602)
Right-click delete is not an option on Snow Leopard, for some reason.
[ Parent | on HN ]
Re:An update on attempted man-in-the-middle attacks by sid0 on Tuesday August 30, 2011 @04:20AM (#2940567)
Firefox uses its own CA store, so you need to remove it there too (or wait for the 6.0.1 update).
[ Parent | on HN ]