Path: csiph.com!usenet.pasdenom.info!weretis.net!feeder4.news.weretis.net!eternal-september.org!feeder.eternal-september.org!mx04.eternal-september.org!.POSTED!not-for-mail
From: Arno Welzel <usenet@arnowelzel.de>
Newsgroups: comp.lang.php
Subject: Re: PHP mysql_excape but need to search for those items
Date: Thu, 14 Jun 2012 08:47:28 +0200
Organization: A noiseless patient Spider
Lines: 49
Message-ID: <4FD98900.7040306@arnowelzel.de>
References: <3c8fad99-d356-4d8c-acfb-a1fe06503254@v9g2000vbc.googlegroups.com> <jr56ua$fk1$1@dont-email.me> <d2f0a619-1b69-45c0-97c7-9790ed073148@cu1g2000vbb.googlegroups.com> <jr5bdj$eth$1@dont-email.me> <a3ms9vF4htU1@mid.individual.net> <jr5mlh$u0e$1@dont-email.me> <4FD70D4F.2050104@arnowelzel.de> <jr7b0k$g6a$1@dont-email.me>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Injection-Info: mx04.eternal-september.org; posting-host="l9c/A+zTZgD4vXu1XJ7hjg"; logging-data="31551"; mail-complaints-to="abuse@eternal-september.org";	posting-account="U2FsdGVkX1+vrB0jhi7fgFq6jmo/UHOfGT3CR5eFJeo="
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20120428 Thunderbird/12.0.1
In-Reply-To: <jr7b0k$g6a$1@dont-email.me>
Cancel-Lock: sha1:7nkEIofsDL6aUSM2QgduHe9HQi0=
Xref: csiph.com comp.lang.php:6324

Jerry Stuckle, 12.06.2012 14:00:

> On 6/12/2012 5:35 AM, Arno Welzel wrote:
>> Jerry Stuckle, 11.06.2012 23:06:
>>
>>> On 6/11/2012 2:38 PM, J.O. Aho wrote:
>> [...]
>>>> Don't forget man in the middle, using https will not protect against
>>>> that.
>>>
>>> Actually, it will.  HTTPS transmissions are encrypted between the client
>>> and the server using public/private key encryption.  That's the whole
>>> purpose of HTTPS.
>>
>> But only if the client *only* trusts the specific certificate. Otherwise
>> the man in the middle can just set up a proxy which also accepts SSL
>> connections and provides a valid certificate. There have been a number
>> of broken CAs in the past which allowed virtually anyone to create
>> signed and "trusted" certificates for any domain
> 
> Setting up a proxy would mean alternations to the domain name servers
> data.  Additionally, the certificate either would not match the domain
> name or the certificate would not be signed by a recognized authority
> (which is a good reason to use a trusted certificate).

Nameservers can be compromised - e.g. by cache poisoning.

> I don't know of any broken CAs in the past, but there could have been.
> However, the ones I use won't issue a certificate just to anyone.

And these are?

Just as a reminder: DigiNotar, Comodo, RSA - just to name a few who
already got compromised.

Also see:

<http://blogs.comodo.com/it-security/data-security/the-recent-ra-compromise/>

<http://www.itscolumn.com/2011/09/certificate-authority-hacked-google-faced-mitm-attack/>

The whole model of trusting CAs and not single certificates (as in SSH)
must be considered broken.


-- 
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de