Juergen Christoffel wrote: > On Thu, Apr 10, 2014 at 11:32:21PM -0700, Paul Vixie wrote: >> [...] >> really bruce? on a scale of doesn't-matter-at-all to >> worst-thing-you-could-have-previously-imagined, a read only exploit is >> even worse than that? > > With all due respect to your ego Paul, I think you might > under-estimate the > long term effects: private keys get stolen, this allows people to play > man-in-the-middle, people (the masses) will renew their certificates but > might re-use their generated private keys because the don't know exactly > what they are doing, etc.
thanks for whatever respect may be due, but bruce is still wrong. the cost to fix this is: 1. replace all private keys 2. replace all passwords 3. upgrade all SSL software that rates 9 out of 10, where 10 is the worst thing i could have imagined pre-heartbleed, which is remote file modification and/or remote code execution, because the costs in that case would be: 1. inclusive of [1..3] above 2. replace all operating systems 3. audit or replace all user data > As the EFF's traces back into 2013 might tell us, some bad guys exploited > this for some time now. If this is the case, we might soon arrive at the > conclusion that we need to exchange all certificates which had been > created > in the last two years. we already have to do that, since we have to assume the worst whenever we don't have log files which somehow prove a negative. > > While I hope it tends to your interpretation, I fear a bit that it > might be > Bruces in the long run. bruce was spouting nonsense. heartbleed's costs will not be higher than previously imaginable. vixie _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
