Re:CloudFlare's Heartbleed challenge cracked
by jsmeaton on Saturday April 12, 2014 @02:41AM
(#7577182)
The point is you can connect to it with HTTPS and your browser doesn't throw up big flashy warnings. It's basically proof that he has got the private key, since he can impersonate cloudfarechallenge.com with regards to SSL.
[ Parent
| on HN ]
Re:CloudFlare's Heartbleed challenge cracked
by pushrax on Saturday April 12, 2014 @01:52PM
(#7578547)
Yes, of course. That's why it's a successful "man in the middle attack" of sorts. If the cert wasn't trusted then it would mean nothing.
Re:CloudFlare's Heartbleed challenge cracked
by Theriac25 on Saturday April 12, 2014 @02:51AM
(#7577192)
He doesn't have to have the private key, only a private key that was signed by any of the hundreds (counting intermediate CAs, thousands?) CAs trusted by his browser.
Re:CloudFlare's Heartbleed challenge cracked
by gojomo on Saturday April 12, 2014 @03:17AM
(#7577229)
He has to have the private key that matches the certificate he's presenting.
He's presenting the CloudFlare-obtained cert (which the site offers up on request), so the lack of a warning means he's got that private key.
Getting another CA-signed certificate, naming 'www.cloudflarechallenge.com' and matching another private key, would itself be an impressive compromise, though not the challenge CloudFlare made or what he's demonstrating.
Re:CloudFlare's Heartbleed challenge cracked
by cpach on Saturday April 12, 2014 @04:33AM
(#7577329)
See here how to verify that Indutny indeed snatched the private key from Cloudflare’s server: http://dankaminsky.com/2014/04/12/bloody-cert-certified/
Re:CloudFlare's Heartbleed challenge cracked
by paulbaumgart on Saturday April 12, 2014 @03:10AM
(#7577220)
CAs will verify that you at least have control over hostmaster@ or an email listed in the WHOIS info for the domain before issuing certs.