3 ms·
Oh yes, that's true. (Though now I wonder if cert negotiation can be dependent on useragent under SNI. It could certainly be dependent on TCP fingerprint charac
by cjbprime 7y ago
Oh yes, that's true. (Though now I wonder if cert negotiation can be dependent on useragent under SNI. It could certainly be dependent on TCP fingerprint characteristics.)
Agree with you that codesigning certs are a more likely problem space for this bug.
- atxlurker 7y agoI don’t think this is ultimately the vulnerability, but even without SNI, it’s arbitrary to dynamically link to a file, script, png, etc... hosted on a sub domain with the bad cert.
- cjbprime 7y agoOh yeah! So it's like: * client asks for cert * you give it to them * client tells you the page they want and their useragent * if you think they're vulnerable based on what you've learned about them, you add <img src="https://vulnerable.subdomain/"> https://vulnerable.subdomain/"> to the response. Neat suggestion. Thanks! Agree we've moved well outside of tomorrow's likely actual vuln.