Why Clinton’s Private Email Server Was Such a Security Fail

Re:Why Clinton’s Private Email Server Was Such a Security Fail by vidarh on Thursday March 05, 2015 @06:03AM (#9150057)

Note the "if you pin them" part. Pin in this context means you have the identity of the specific certificate stored on your client, and so you are not depending on whether or not it is being declared by some CA to be be valid for the server in question. Instead you are expecting that exact certificate.

That it is a private cert does not make it any more secure, but pinning is more secure, and with a pinned cert, having the cert signed by a CA gives no additional security.

[ Parent | on HN ]

Re:Why Clinton’s Private Email Server Was Such a Security Fail by VieElm on Thursday March 05, 2015 @11:47AM (#9151880)

And how do you know you're not pinning the MTIM cert?

[ Parent | on HN ]

Re:Why Clinton’s Private Email Server Was Such a Security Fail by zaroth on Friday March 06, 2015 @12:58AM (#9155800)

Because it's your cert that you just installed on your server, so you know its thumbprint.

This is effectively what you are doing every time you connect to a server over SSH and say 'yes' to that message with the funny string asking, "Are you sure you want to connect?" It's analogous to pinning a self-signed certificate.

[ Parent | on HN ]