Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > alt.os.linux > #28521 > unrolled thread

Re: I wish I understood SSL Certificates better when they ask

Back to article view | Back to alt.os.linux

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: I wish I understood SSL Certificates better when they ask Mike Easter <MikeE@ster.invalid> - 2015-06-12 16:50 -0700
    Re: I wish I understood SSL Certificates better when they ask Mike Easter <MikeE@ster.invalid> - 2015-06-12 22:59 -0700
      Re: I wish I understood SSL Certificates better when they ask Richard Kettlewell <rjk@greenend.org.uk> - 2015-06-14 18:34 +0100
      Re: I wish I understood SSL Certificates better when they ask Michael Baeuerle <michael.baeuerle@stz-e.de> - 2015-06-15 08:04 +0000

#28521 — Re: I wish I understood SSL Certificates better when they ask

Posted to a.o.l only

Werner Obermeier wrote:
> I wish I understood SSL Certificates better when they ask
> me to accept a certificate from my bank.
>
> http://i.imgur.com/1mizR6B.jpg
>
> How do I make this decision?

I would look at the bankofamerica.com domain carefully for reassurance 
that I was at the correct address, which you are.

> Just now, I logged into my Bofa account from my home using
> the same browser and computer and IP address that I normally
> use.
>
> Bofa allowed me to log in, but, when I hit one of the billpay
> options, it asked me to download that SSL certificate because
> the previous certificate expired a few days ago.
>
> You'd think that a big bank would fix this in 3 days.

Yes they should; however, it is not an uncommon oversight.  It might not 
even be BoA's fault but that of the CA.

> Also, I'm using my normal browser & IP address.
> And, the domain appears to be a valid domain.

Correct.

> How do I decide if I should accept this certificate?

On that basis.  You/We know that the bankofamerica.com domain is where 
you want to be and there is no 'typo' in there.

> PS: I obfuscated the URL just in case it was specific to my
> BofA account. Did I need to do that or does the URL not matter?

In case the URL had anything to do with your account, you might as well 
obfuscate that part.  That part isn't important to discuss the issue here.

Not every question about a certificate problem is going to have the same 
answer.


-- 
Mike Easter

[toc] | [next] | [standalone]

#28532

Werner Obermeier wrote:
> I presume the certificating authority hands them a new certificate.
>
> But, how does that just-today-updated certificate get back to my browser?

The new certificate has a good date on it.

https://www.us-cert.gov/ncas/tips/ST05-010  Understanding Web Site 
Certificates


-- 
Mike Easter

[toc] | [prev] | [next] | [standalone]

#28604

Werner Obermeier <spamfreewob@arcor.de> writes:
> Mike Easter <MikeE@ster.invalid> wrote:
>> It comes with your Firefox browser and you can modify it.
>
> This is what scares me about the so-called 'root' certificates.
>
> If they're stored on my machine (either by the browser or the OS), 
> then, anyone can put a malicious one there (since home machines just
> can't be secured, period - when even government machines can't be 
> secured with huge IT departments protecting them).
>
> So, isn't that an extremely weak link in the chain?

Yes and no.

No, in the sense that it’s no weaker than any other part of your
computer.  The same attacker might instead modify your browser or OS,
rendering all other security measures irrelevant.

Yes, in the sense that attackers do modify the list of root CAs, given
the opportunity.  For example:
https://en.wikipedia.org/wiki/Superfish#Lenovo_security_incident

--
http://www.greenend.org.uk/rjk/

[toc] | [prev] | [next] | [standalone]

#28618

David W. Hodgins wrote:
> Werner Obermeier wrote:
> > 
> > This is what scares me about the so-called 'root' certificates.
> > If they're stored on my machine (either by the browser or the OS),
> > then, anyone can put a malicious one there (since home machines just
> > can't be secured, period - when even government machines can't be
> > secured with huge IT departments protecting them).
> > So, isn't that an extremely weak link in the chain?
> 
> Not really. When a certificate authority is caught doing things they
> shouldn't be doing, their ability to sign certificates is revoked, so
> all certificates they've signed immediately become invalid too.
> https://en.wikipedia.org/wiki/Revocation_list

The problem is that not all software don't check whether a certificate
was revoked. CRLs can be large (e.g. several megabytes for CAcert) and
with a low bandwith connection it can hurt downloading them on-the-fly
while opening a connection.

WWW browsers normally prefer OCSP for revocation checking, but then
nevertheless accept the certificate if they get no response.

Because of this weak revocation system, it is a good idea to set the
validity period of certificates not too far into the future (so at least
the expiration eventually invalidate the certificate).

[toc] | [prev] | [standalone]

Back to top | Article view | alt.os.linux

csiph-web