Re: [Full-disclosure] Five Ways to Screw Up SSL

[Florian Weimer <fw@xxxxxxxxxxxxx>]

* Michal Zalewski:

>> SSL Mistake #2 - Assuming a signed certificate is the right
>> certificate
>
> I don't understand what you're trying to say here: it seems to me that
> you're suggesting that allowing all users with a valid certificate the
> same privileges is a bad idea. Probably, but this has little to do with
> certificates or SSL - the same may be true for passwords or any other
> scheme.

There are some APIs in wide use which encourage this kind of misuse
(authenticate the CA, not the certificate holder) because doing it
right is somewhat difficult or allegedly has a performance impact
(copying the entire certificate to an environment variable, for
example).

>> SSL Mistake #3 - Falling back to TCP

> You are very, very seriously confused about the relation between SSL, TCP,
> and just about everything else.

Fallback to non-encrypted connections is quite common for protocols
like SMTP and IMAP.  I doubt this is a significant issue.  Protection
against passive eavesdropping is better than no protection at all.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/