News for hackers. Stuff that matters.

A comment on CloudFlare's Heartbleed challenge cracked. Parent comment

Re:CloudFlare's Heartbleed challenge cracked by Theriac25 on Saturday April 12, 2014 @02:51AM (#7577192)
He doesn't have to have the private key, only a private key that was signed by any of the hundreds (counting intermediate CAs, thousands?) CAs trusted by his browser.
[ Parent | on HN ]
Re:CloudFlare's Heartbleed challenge cracked by gojomo on Saturday April 12, 2014 @03:17AM (#7577229)
He has to have the private key that matches the certificate he's presenting.

He's presenting the CloudFlare-obtained cert (which the site offers up on request), so the lack of a warning means he's got that private key.

Getting another CA-signed certificate, naming 'www.cloudflarechallenge.com' and matching another private key, would itself be an impressive compromise, though not the challenge CloudFlare made or what he's demonstrating.

[ Parent | on HN ]
Re:CloudFlare's Heartbleed challenge cracked by cpach on Saturday April 12, 2014 @04:33AM (#7577329)
See here how to verify that Indutny indeed snatched the private key from Cloudflare’s server: http://dankaminsky.com/2014/04/12/bloody-cert-certified/
[ Parent | on HN ]
Re:CloudFlare's Heartbleed challenge cracked by paulbaumgart on Saturday April 12, 2014 @03:10AM (#7577220)
CAs will verify that you at least have control over hostmaster@ or an email listed in the WHOIS info for the domain before issuing certs.
[ Parent | on HN ]