News for hackers. Stuff that matters.
Re:How to Use Secure Sockets in C on Linux by Rygian on Tuesday June 18, 2024 @06:39AM (#40716106)
I would have liked to see the logic on client side to decide if the certificate presented by the server is valid.
[ Parent | on HN ]
Re:How to Use Secure Sockets in C on Linux by Retr0id on Tuesday June 18, 2024 @08:26AM (#40716985)
I'm a little surprised the OpenSSL API doesn't force you to consider this by default, but indeed it does not: https://www.openssl.org/docs/manmaster/man3/SSL_CTX_new.html...

> On session establishment, by default, no peer credentials verification is done. This must be explicitly requested, typically using SSL_CTX_set_verify(3).

Aside: According to those docs, SSLv23_client_method() is deprecated.

[ Parent | on HN ]
Re:How to Use Secure Sockets in C on Linux by Severian on Tuesday June 18, 2024 @08:33AM (#40717064)
Yeah, not verifying server cert or OCSP/CRLs is a problem. DNS attacks can redirect and you'd be none the wiser.
[ Parent | on HN ]
Re:How to Use Secure Sockets in C on Linux by ranger_danger on Tuesday June 18, 2024 @12:10PM (#40719447)
The page was updated to include that.
[ Parent | on HN ]
Re:How to Use Secure Sockets in C on Linux by Rygian on Wednesday June 19, 2024 @07:05AM (#40727069)
Well done!
[ Parent | on HN ]
Re:How to Use Secure Sockets in C on Linux by Icathian on Tuesday June 18, 2024 @08:26AM (#40716993)
This is a really nice part 1. I think a series building from this up to what would be considered "secure" in modern day, with the other topics already mentioned in comments here and on the article, would be awesome. I could easily see it becoming a very popular resource among students or new devs who are solving these problems for the first time themselves. The writing is very clear and concise.
[ Parent | on HN ]