Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #6337

Re: PHP mysql_excape but need to search for those items

Show all headers | View raw

Jerry Stuckle, 14.06.2012 13:40:

> On 6/14/2012 2:47 AM, Arno Welzel wrote:
>> Jerry Stuckle, 12.06.2012 14:00:
[...]
>>> Setting up a proxy would mean alternations to the domain name servers
>>> data.  Additionally, the certificate either would not match the domain
>>> name or the certificate would not be signed by a recognized authority
>>> (which is a good reason to use a trusted certificate).
>>
>> Nameservers can be compromised - e.g. by cache poisoning.
>>
> 
> And exactly how often has that occurred?  And who has the tools to do it?

To read more about: <http://www.kb.cert.org/vuls/id/800113>

Just because you can not imagine that his happens in reality does not
mean that you can ignore the problem.

I must admit that this problem is well known now for about 4 years and
hopefully anyone who's responsible for a nameserver did solve this - but
i mentioned it to show that "security" is not just "i use SSL, this i
secure".

>>> I don't know of any broken CAs in the past, but there could have been.
>>> However, the ones I use won't issue a certificate just to anyone.
>>
>> And these are?
>>
> 
> Thwate, for one.  Verisign for another.

VeriSign is also on the list of the CAs which had at least one security
problem:

<http://www.reuters.com/article/2012/02/02/us-hacking-verisign-idUSTRE8110Z820120202>

Of course they will never tell you about any details and of course you
shall believe that everything is perfectly fine.

And not to forget:

<http://www.thetechherald.com/articles/DigiNotar-security-incident-goes-from-bad-to-worse>

"In total, 531 fraudulent certificates were issued during the DigiNotar
breach, including certificates for Google, Microsoft, MI6, the CIA, TOR,
Mossad, Skype, Twitter, Facebook, Thawte, VeriSign, and Comodo."

Do you still believe, the CA system is trustworthy?

>> Just as a reminder: DigiNotar, Comodo, RSA - just to name a few who
>> already got compromised.
>>
>> Also see:
>>
>> <http://blogs.comodo.com/it-security/data-security/the-recent-ra-compromise/>
>>
>>
>> <http://www.itscolumn.com/2011/09/certificate-authority-hacked-google-faced-mitm-attack/>
>>
>>
>> The whole model of trusting CAs and not single certificates (as in SSH)
>> must be considered broken.
> 
> And you have a better solution?

As i already said: Don't trust a CA, only trust (or don't trust) the
certificate. If it changes your browser will immediately tell you - even
if it was signed by a CA.


-- 
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

PHP mysql_excape but need to search for those items mrgushi <mrgushi@gmail.com> - 2012-06-11 08:34 -0700
  Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-11 17:54 +0200
    Re: PHP mysql_excape but need to search for those items mrgushi <mrgushi@gmail.com> - 2012-06-11 09:48 -0700
      Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-12 11:26 +0200
  Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-11 12:38 -0400
    Re: PHP mysql_excape but need to search for those items mrgushi <mrgushi@gmail.com> - 2012-06-11 10:01 -0700
      Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-11 13:54 -0400
        Re: PHP mysql_excape but need to search for those items "J.O. Aho" <user@example.net> - 2012-06-11 20:38 +0200
          Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-11 17:06 -0400
            Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-12 11:35 +0200
              Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-12 08:00 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-14 08:47 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-14 07:40 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-15 22:36 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-15 21:07 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-16 08:33 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-16 09:25 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-18 09:39 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-18 08:48 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-18 19:30 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-18 13:41 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-18 19:49 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-18 15:10 -0400
                Re: PHP mysql_excape but need to search for those items Michael Fesser <netizen@gmx.de> - 2012-06-18 20:21 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-18 15:11 -0400
                Re: PHP mysql_excape but need to search for those items Michael Fesser <netizen@gmx.de> - 2012-06-18 21:34 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-18 17:22 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-19 15:36 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-19 10:41 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-19 17:34 +0200
                Re: PHP mysql_excape but need to search for those items Jerry Stuckle <jstucklex@attglobal.net> - 2012-06-19 12:35 -0400
                Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-19 18:39 +0200
      Re: PHP mysql_excape but need to search for those items Arno Welzel <usenet@arnowelzel.de> - 2012-06-12 11:32 +0200
  Re: PHP mysql_excape but need to search for those items "Álvaro G. Vicario" <alvaro.NOSPAMTHANX@demogracia.com.invalid> - 2012-06-12 09:38 +0200

csiph-web