189 reputation
8
bio website caesarsgrunt.com
location Atlantic Ocean
age
visits member for 1 year, 3 months
seen 2 hours ago

Sep
3
accepted Why does Google SSL cert change so frequently?
Sep
3
comment Why does Google SSL cert change so frequently?
Also, presumably there is no way to detect MITMs when they are doing this, right? But presumably they think that's a worthwhile tradeoff since nobody bothers with cert pinning anyway.
Sep
3
comment Why does Google SSL cert change so frequently?
That would make sense, except that they switch between two different CAs (both their own; but with different roots). Why would that be?
Aug
31
comment Why does Google SSL cert change so frequently?
Also, this doesn't explain why they alternate between two different CA names. (I didn't mention this originally; sorry...)
Aug
31
revised Why does Google SSL cert change so frequently?
added 28 characters in body
Aug
31
comment Why does Google SSL cert change so frequently?
Interesting. But the blog post you link to describes a different key exchange algorithm (ECDHE-RC4-SHA) to achieve forward secrecy; it doesn't mention generating new certificates every time.
Aug
30
asked Why does Google SSL cert change so frequently?
Jul
14
awarded  Citizen Patrol
Jul
12
comment How exactly is MD5 vulnerable to collission attacks?
Ah, right - so in fact poor collision resistance is not a problem in that situation. Thanks for the answer/link.
Jul
12
comment How exactly is MD5 vulnerable to collission attacks?
The example on that site involves doctoring BOTH documents, Prior to having one of them signed. is there a way to execute the attack when the original, authentic document has already been signed - ie by only doctoring ONE file, to match the existing one?
Jul
5
awarded  Critic
Jul
4
awarded  Nice Question
Jun
30
awarded  Editor
Jun
30
awarded  Scholar
Jun
30
accepted Can a nation-state adversary perform a MITM attack by compelling a CA to issue them with fake certs?
Jun
30
revised Can a nation-state adversary perform a MITM attack by compelling a CA to issue them with fake certs?
spelling
Jun
30
comment Can a nation-state adversary perform a MITM attack by compelling a CA to issue them with fake certs?
Ah yes, of course, my mistake. Still, I guess they could get hold of the private key of a specific site by subpoenaing the operators of the site for it (and requiring them not tell anyone). But at least this can't be done as a "generic" attack on all sites.
Jun
30
comment Can a nation-state adversary perform a MITM attack by compelling a CA to issue them with fake certs?
Is there any reason why it would have to be a different cert? In other words, couldn't the CA issue identical certs to both Google and the NSA (for example)? Such as by duplicating the cert when they originally generate it, and handing a copy to the NSA? Clearly this would require prearrangement, but is there any technical reason why it wouldn't be possible? (Also, if you could go into more detail about "interesting solutions such as TACK and Public Key Pinning, which aim to make it possible for any server admin to temporarily pin keys to their domains", that would be great.)
Jun
30
awarded  Student
Jun
30
asked Can a nation-state adversary perform a MITM attack by compelling a CA to issue them with fake certs?