550 reputation
214
bio website
location
age
visits member for 2 years, 6 months
seen Jul 17 at 12:15

Feb
26
comment SSL fingerprint inconsistency: what does it mean?
@YoavAner: As I understand (tools.ietf.org/html/rfc3280#section-3.3), each CA maintains a public repository with a CA revocation list, basically listing each revoked certificate by serial number. Then each browser uses the OCS protocol to retrieve it (tools.ietf.org/html/rfc2560). So it's fast (1-2hours), I agree. But how about keeping the spare certificates and not deploy them randomly inside a cluster? This way you can be sure that they didn't leak. If one cert has leaked, why not the others? How facebook's methods does actually improve security?
Feb
26
comment SSL fingerprint inconsistency: what does it mean?
This looks very correct. I edited my question over time to ask what potential benefits such a set up can bring from a security point of view. Do you know any paper or public recommendation that talks about multiple certificates? Surely if it's a good practice there should be some kind of paper/presentation about it.
Feb
26
revised SSL fingerprint inconsistency: what does it mean?
added 314 characters in body
Feb
26
awarded  Promoter
Feb
24
answered Can I detect a MITM attack?
Feb
24
revised SSL fingerprint inconsistency: what does it mean?
added 537 characters in body
Feb
23
awarded  Student
Feb
23
awarded  Commentator
Feb
23
comment SSL fingerprint inconsistency: what does it mean?
How does this improve security? If you have time to revoke a leaked certificate, you have time to buy another one too. Your theory is however right. I'd like to hear other opinions or ideas so I'll let this question open for a few days. Thank you.
Feb
23
comment SSL fingerprint inconsistency: what does it mean?
Could be, but do you know why the blue cert on the graph is sometimes replaced by others? It doesn't make sense. I would like to be sure about this. I think this deserve a real analysis of the problem by a security expert, the cert changes don't occur on a regular basis. My wildest guest would be the entry for facebook in their DNS caches expires, they ask for the new address and it's a different server with a different cert. But it doesn't seem to happen regularly again... if I am right it's very strange that we don't observe a pattern, cached entries should expire regularly...
Feb
23
comment SSL fingerprint inconsistency: what does it mean?
@EugeneMayevski'EldoSCorp: Agreed. But why would they share the same certificate (the blue key on the graph) across many different nodes? The servers probing facebook are supposed to be located in different areas in order to provide the user a global view. So if one cert is leaked and revoked, all hosts probed by perspective will have to change their conf at some point. If that's what facebook is doing, that is.
Feb
22
comment SSL fingerprint inconsistency: what does it mean?
Given cert1, cert2 and cert3, if cert1 is leaked, then it can be used anyways. Each certificate can be used to do a MITM. As perspective noted on the screenshot: "The browser trusts this site and requires no security exception". So if a server in one location gets the cert leaked, the attacker can use it wherever he wants. And on the screenshot we can see that all certificates are used at different locations, so it's not location-based, they are switched on a global scale and only one seem to be there most of the time (and is not suspicious). I really don't get it :/...
Feb
22
comment SSL fingerprint inconsistency: what does it mean?
Is there a valid reason to do that? It's important to know. Or should we just trust? Besides, what if facebook doesn't know about this and someone else is performing MITMs attacks? I want to get to the bottom of this.
Feb
22
asked SSL fingerprint inconsistency: what does it mean?
Feb
11
answered Which is the most vulnerable to MITM attacks, SSL or SSH?
Feb
7
revised References to issues of putting backdors into opensource (like OpenBSD) by FBI or CIA
edited body
Feb
7
comment References to issues of putting backdors into opensource (like OpenBSD) by FBI or CIA
You can dig through the full-disclosure mailing list archives as well, I recall seeing a funny issue about a well visible backdoor in an opensource software. The code was even commented saying that nobody even bothered looking at the code except bad guys. Underlining the failure of opensource in providing more code review/security 99% of the time.
Feb
7
revised References to issues of putting backdors into opensource (like OpenBSD) by FBI or CIA
added 1031 characters in body
Feb
7
comment References to issues of putting backdors into opensource (like OpenBSD) by FBI or CIA
Wiil do. The mails linked are 1 day earlier than the article linked in the question. You have dozens of mails (just click next in thread) from developers explaining the situation and investigating the allegation. Proof of their work can be found on the openbsd-cvs mailing list, just look for commits after December 14th 2010. They don't like to waste time and make public announcements, so the information is right there, in the tech mailing list and the CVS logs. Other blogs and paper just extrapolate information from these sources.
Feb
7
awarded  Teacher