Re: PHP mysql_excape but need to search for those items

From	Arno Welzel <usenet@arnowelzel.de>
Newsgroups	comp.lang.php
Subject	Re: PHP mysql_excape but need to search for those items
Date	2012-06-14 08:47 +0200
Organization	A noiseless patient Spider
Message-ID	<4FD98900.7040306@arnowelzel.de> (permalink)
References	(3 earlier) <jr5bdj$eth$1@dont-email.me> <a3ms9vF4htU1@mid.individual.net> <jr5mlh$u0e$1@dont-email.me> <4FD70D4F.2050104@arnowelzel.de> <jr7b0k$g6a$1@dont-email.me>

Show all headers | View raw

Jerry Stuckle, 12.06.2012 14:00:

> On 6/12/2012 5:35 AM, Arno Welzel wrote:
>> Jerry Stuckle, 11.06.2012 23:06:
>>
>>> On 6/11/2012 2:38 PM, J.O. Aho wrote:
>> [...]
>>>> Don't forget man in the middle, using https will not protect against
>>>> that.
>>>
>>> Actually, it will.  HTTPS transmissions are encrypted between the client
>>> and the server using public/private key encryption.  That's the whole
>>> purpose of HTTPS.
>>
>> But only if the client *only* trusts the specific certificate. Otherwise
>> the man in the middle can just set up a proxy which also accepts SSL
>> connections and provides a valid certificate. There have been a number
>> of broken CAs in the past which allowed virtually anyone to create
>> signed and "trusted" certificates for any domain
> 
> Setting up a proxy would mean alternations to the domain name servers
> data.  Additionally, the certificate either would not match the domain
> name or the certificate would not be signed by a recognized authority
> (which is a good reason to use a trusted certificate).

Nameservers can be compromised - e.g. by cache poisoning.

> I don't know of any broken CAs in the past, but there could have been.
> However, the ones I use won't issue a certificate just to anyone.

And these are?

Just as a reminder: DigiNotar, Comodo, RSA - just to name a few who
already got compromised.

Also see:

<http://blogs.comodo.com/it-security/data-security/the-recent-ra-compromise/>

<http://www.itscolumn.com/2011/09/certificate-authority-hacked-google-faced-mitm-attack/>

The whole model of trusting CAs and not single certificates (as in SSH)
must be considered broken.


-- 
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de

Thread

PHP mysql_excape but need to search for those items mrgushi <mrgushi@gmail.com> - 2012-06-11 08:34 -0700
  Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-11 17:54 +0200
    Re: PHP mysql_excape but need to search for those items mrgushi <mrgushi@gmail.com> - 2012-06-11 09:48 -0700
      Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-12 11:26 +0200
  Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-11 12:38 -0400
    Re: PHP mysql_excape but need to search for those items mrgushi <mrgushi@gmail.com> - 2012-06-11 10:01 -0700
      Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-11 13:54 -0400
        Re: PHP mysql_excape but need to search for those items "J.O. Aho" <user@example.net> - 2012-06-11 20:38 +0200
          Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-11 17:06 -0400
            Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-12 11:35 +0200
              Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-12 08:00 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-14 08:47 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-14 07:40 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-15 22:36 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-15 21:07 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-16 08:33 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-16 09:25 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-18 09:39 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-18 08:48 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-18 19:30 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-18 13:41 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-18 19:49 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-18 15:10 -0400
                Re: PHP mysql_excape but need to search for those items Michael Fesser <netizen@gmx.de> - 2012-06-18 20:21 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-18 15:11 -0400
                Re: PHP mysql_excape but need to search for those items Michael Fesser <netizen@gmx.de> - 2012-06-18 21:34 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-18 17:22 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-19 15:36 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-19 10:41 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-19 17:34 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-19 12:35 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-19 18:39 +0200
      Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-12 11:32 +0200
  Re: PHP mysql_excape but need to search for those items "Álvaro G. Vicario" <alvaro.NOSPAMTHANX@demogracia.com.invalid> - 2012-06-12 09:38 +0200

csiph-web