200 PS3's Break VeriSign's SSL

Status
Not open for further replies.

ossie

Distinguished
Aug 21, 2008
79
0
18,580
microsuxx still faithful to it's corporate spin - security by obscurity - but this "security" model is proven to fail all over again, the unknown been when it'll be defeated, not if.
 

Darkk

Distinguished
Oct 6, 2003
253
0
18,930
I have to wonder tho. Remember when 40bit SSL certs was safe until somebody at distributed.net cracked it in 3 days then everybody switched it to 128bit certs? It cost money and time to make the switch.

So have to wonder, is this some kind of a scheme to scare people into "OMG" and force everybody to update their SSL certs?

Attempting to crack security products aren't new, just when they get the media involved people start to panic.
 

zodiacfml

Distinguished
Oct 2, 2008
249
0
18,830
computing security is a balancing act.
that might be dangerous but ssl is not the only security precaution on the internet.
 

nekatreven

Distinguished
Feb 20, 2007
246
0
18,830
the issue here is that they AREN'T 'fake certs'. they hacked the site and started creating cryptographically IDENTICAL certs. A hash is a hash folks.

That's like someone coming up with a way to make clones of diamonds that come out 100% correct on a molecular level, and then calling the clones fake.

If the chemist can't tell and the jeweler can't tell and it cuts the other damn diamond...WHO CARES.

Same with these certs.

Even if the CA finds the issue and removes the certs from their records, it's STILL a cryptographically valid cert.

If you were to re-buy the cert...this time legit...the hash would still be the same. I bet you wouldn't even have to re-install the old, supposedly fake, certificates.
 

nekatreven

Distinguished
Feb 20, 2007
246
0
18,830
Of course I get what can be done with it. That's not hard.

At first I did think this referred to generating certs that never existed before. I suppose it refers to making copies of existing ones. That doesn't really matter either way though.

Even in trying to explain it to me...you just called the cert fake. If it was fake, the victim's browser would not accept it.

A 'copied cert' or a 'stolen cert' perhaps, but if the hashes match, it isn't fake. I don't really think people are grasping that concept.

Like if I had a program that generated duplicates of valid nuclear launch codes...you'd call them fake. That's dangerous.

"...and as the missile boar down upon them they thought to themselves, 'hey maybe fake was the wrong choice of wording here.'..."

This obviously isn't as dire as nuclear warheads, but I still think it is very unwise to call these certs fake. I guess for now I should just be happy they are phasing out md5.
 
Status
Not open for further replies.