3 ms·
This isn't a "crypto flaw" at all. It's a flaw in common name validation that circumvents the normal CA trust chain. So I'd say it's worse than a crypto flaw s
by stanleydrew 10y ago
This isn't a "crypto flaw" at all. It's a flaw in common name validation that circumvents the normal CA trust chain.
So I'd say it's worse than a crypto flaw since it's much easier to exploit. And there was code explicitly written to circumvent the normal path.
So extra work had to be done in order to make things less secure. That's the reverse of what you'd normally expect, which is that security flaws arise from organizational or individual "laziness."
- revelation 10y agoOne could say it's a backdoor in certificate validation.
- Dylan16807 10y agoI wouldn't call it a backdoor because it's such a simple and obvious bug, in no way hidden or obfuscated. It's just an utter catastrophe of design, to check the name on the certificate instead of the signature.
- satysin 10y agoYeah that is exactly what they want you to think! "Oh it can't be a backdoor as it was so obvious it was just a mistake". Hmmmmmmm.
- Dylan16807 10y agoEven if it's intentional, at some point of obviousness it starts being a front door. They already have multiple backdoors and they have a proven history of poor implementation.