540 reputation
213
bio website
location
age
visits member for 2 years, 2 months
seen Feb 27 at 23:42

Feb
23
comment SSL fingerprint inconsistency: what does it mean?
How does this improve security? If you have time to revoke a leaked certificate, you have time to buy another one too. Your theory is however right. I'd like to hear other opinions or ideas so I'll let this question open for a few days. Thank you.
Feb
23
comment SSL fingerprint inconsistency: what does it mean?
Could be, but do you know why the blue cert on the graph is sometimes replaced by others? It doesn't make sense. I would like to be sure about this. I think this deserve a real analysis of the problem by a security expert, the cert changes don't occur on a regular basis. My wildest guest would be the entry for facebook in their DNS caches expires, they ask for the new address and it's a different server with a different cert. But it doesn't seem to happen regularly again... if I am right it's very strange that we don't observe a pattern, cached entries should expire regularly...
Feb
23
comment SSL fingerprint inconsistency: what does it mean?
@EugeneMayevski'EldoSCorp: Agreed. But why would they share the same certificate (the blue key on the graph) across many different nodes? The servers probing facebook are supposed to be located in different areas in order to provide the user a global view. So if one cert is leaked and revoked, all hosts probed by perspective will have to change their conf at some point. If that's what facebook is doing, that is.
Feb
22
comment SSL fingerprint inconsistency: what does it mean?
Given cert1, cert2 and cert3, if cert1 is leaked, then it can be used anyways. Each certificate can be used to do a MITM. As perspective noted on the screenshot: "The browser trusts this site and requires no security exception". So if a server in one location gets the cert leaked, the attacker can use it wherever he wants. And on the screenshot we can see that all certificates are used at different locations, so it's not location-based, they are switched on a global scale and only one seem to be there most of the time (and is not suspicious). I really don't get it :/...
Feb
22
comment SSL fingerprint inconsistency: what does it mean?
Is there a valid reason to do that? It's important to know. Or should we just trust? Besides, what if facebook doesn't know about this and someone else is performing MITMs attacks? I want to get to the bottom of this.
Feb
22
asked SSL fingerprint inconsistency: what does it mean?
Feb
11
answered Which is the most vulnerable to MITM attacks, SSL or SSH?
Feb
7
revised References to issues of putting backdors into opensource (like OpenBSD) by FBI or CIA
edited body
Feb
7
comment References to issues of putting backdors into opensource (like OpenBSD) by FBI or CIA
You can dig through the full-disclosure mailing list archives as well, I recall seeing a funny issue about a well visible backdoor in an opensource software. The code was even commented saying that nobody even bothered looking at the code except bad guys. Underlining the failure of opensource in providing more code review/security 99% of the time.
Feb
7
revised References to issues of putting backdors into opensource (like OpenBSD) by FBI or CIA
added 1031 characters in body
Feb
7
comment References to issues of putting backdors into opensource (like OpenBSD) by FBI or CIA
Wiil do. The mails linked are 1 day earlier than the article linked in the question. You have dozens of mails (just click next in thread) from developers explaining the situation and investigating the allegation. Proof of their work can be found on the openbsd-cvs mailing list, just look for commits after December 14th 2010. They don't like to waste time and make public announcements, so the information is right there, in the tech mailing list and the CVS logs. Other blogs and paper just extrapolate information from these sources.
Feb
7
awarded  Teacher
Feb
7
revised References to issues of putting backdors into opensource (like OpenBSD) by FBI or CIA
added 6 characters in body
Feb
7
revised References to issues of putting backdors into opensource (like OpenBSD) by FBI or CIA
added 116 characters in body
Feb
7
awarded  Editor
Feb
7
revised References to issues of putting backdors into opensource (like OpenBSD) by FBI or CIA
added 237 characters in body
Feb
7
comment References to issues of putting backdors into opensource (like OpenBSD) by FBI or CIA
I am not aware of other issues actually, as they say on the ML, the code changes fast and bugs happen all the time. However, what you can check is which where the remotely exploitable bugs on OpenBSD default install, they boast having only a few in a heck of a long time. It might be interesting to see how they happened.
Feb
7
answered References to issues of putting backdors into opensource (like OpenBSD) by FBI or CIA
Feb
5
awarded  Supporter
Feb
5
comment How did anonymous use UTF-16 ASCII to fool PHP escaping?
First make sure admins and devs are all security-aware people. The weakest link will get your server owned in a blink of an eye, assuming a targeted attack.