Re: [Full-disclosure] Slightly OT: What SSL cert do you consider strongest?

[John Adams]

You're forgetting about certificate pinning which defeats MiTM if the
certificate is issued by an unauthorized CA.

For example, here at Twitter we have certificate pinning in all of our
clients to ensure SSL certificates are only signed by trusted CAs and as
well as Chrome.

Emerging standards like TACK and DANE will help greatly with this issue.

-j



On Wed, Oct 23, 2013 at 3:12 AM,  wrote:

> On 22-Oct-2013 16:14:00 -0400, David Miller wrote:
>
>  > After the PRISM and other Snowden leaks, inquiring minds want to
>  > know: whose SSL certs are to be trusted?
>  > Is a self-signed cert likely to be stronger?
>
> Obviously, yes: any issuer in any country may be forced (by local
> authorities) to issue a valid certificate for any host or domain,
> so no one will be able to distinguish between original host with
> updated certificate and MitM proxy operated by feds.
>
>
> --
> Alexey V. Vissarionov aka Gremlin from Kremlin 
> GPG: 8832FE9FA791F7968AC96E4E909DAC45EF3B1FA8 @ hkp://keys.gnupg.net
>
> ___
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Fwd: Re: OT: Firefox question / poll

[John Adams]

On Tue, Dec 20, 2011 at 12:18 PM, Dave  wrote:

> -BEGIN PGP SIGNED MESSAGE-
> Hash: SHA1
>
> On 20/12/2011 17:40, Charles Morris wrote:
> > I'm curious what everyone's opinion is on the following question... esp.
> to any FF dev people on list:
> >
> > Do you think that the Firefox "warning: unresponsive script" is meant as
> a security feature or a usability feature?
>
>
It's neither, but could be construed to be a security feature.

It's a warning to indicate that a javascript included on the page is taking
an excessive amount of time to return control back to the UI.

Unlike the sandboxed javascript model in Chrome, when scripts spin out of
control in FF, they could take the browser down with them. This check
attempts to shutdown scripts that are consuming a crazy amount of resources
and/or are no longer functional.

-j
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] How long was the twitter outage?

[John Adams]

The site was not down for all users. A small number of users were affected
by the failure of specific database node.

Please see our status blog for details.

http://status.twitter.com

-j

On Thu, Dec 23, 2010 at 12:23 PM, Georgi Guninski wrote:

> How long was the twitter outage from yesterday coinciding with the other
> outage?
>
> ___
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Medium security hole in Varnish reverse proxy

[John Adams]

Post some code that people can evaluate.

For starters, There's no reason why varnish ever has to run as root.
It never listens on privileged ports, and the C compiler is never
available over a network interface.

You can ask varnish to reload a configuration and recompile it, but
you'd have to have write access to the filesystem first.  You an also
only cause recompilation to occur if the admin interface is up and
running, which can be easily disabled.

Poul is probably correct. Any vulnerabilities in Varnish with regards
to privilege escalation are configuration issues.

-j

On Mon, Mar 29, 2010 at 12:49 AM, Tim Brown  wrote:
> Hi,
>
> I've identified a couple of security flaws affecting the Varnish reverse proxy
> which may allow privilege escalation. These issues were reported by email to
> the vendor but he feels that it is a configurational issue rather than a 
> design
> flaw.  Whilst I can partially see his point in that the administrative
> interface can be disabled, I'm not convinced that making a C compiler
> available over a network interface without authentication is sound practice,
> especially when the resultant compiled code can be made to run as root rather
> trivially.
>
> Tim
> --
> Tim Brown
> 
> 
>
> ___
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] insecure elements in https protected pages

[John Adams]

Any request on that page that is in http is an insecure element.  
Mixing HTTP and HTTPS on the same page is insecure as the credentials,  
cookies or other identifying data would be sent in the clear to the  
HTTP server.

Install FireBug and watch what pages are loaded, or manually go  
through the HTML and move all page elements over to SSL.


-j

On Oct 18, 2009, at 3:03 PM, Mohammad Hosein wrote:

> in a certain web application e.g gmail there are times the whole  
> communication is secured by ssl and sometimes "there are insecure  
> elements" that raise questions . i'm not a web professional . how to  
> find these insecure elements ? and how to evaluate if these elements  
> are the results of a successful man in the middle attack or not ?
>
> regards
> ___
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/