4 ms·

I wonder how easy it is inside a corporation to get access to the SSL private key? I'm guessing a company like Microsoft doesn't hand that out to their develope

I wonder how easy it is inside a corporation to get access to the SSL private key? I'm guessing a company like Microsoft doesn't hand that out to their developers easily.

jerf 16y ago
You would essentially proxy the request over to ops for decryption. That's how we handle GPG-encrypted vulnerability reports in the company I work for. We don't have out the private key to everybody, I think only two people have it, and they forward back the decrypted result internally to a security mailing list. The first couple of times you tried I would expect a general "WTF?" response from ops (indeed they should ask some pointed questions and not just immediately comply), but once you got over that it wouldn't be hard to put a process in place to deal with this routinely.
- tptacek 16y ago
  Or, instead of building a process for getting your ops team to do unusual things with your site certificate, you could just put up the web page with your GPG key on it.
  - zedshaw 16y ago
    Yes, ideally GPG would be better, but if you only did GPG then companies could simply not publish a key and avoid the whole system. I'm envisioning some combination whereby, if they are already registered on vulnarb.com then you just get their GPG key (hopefully signed by their SSL key), otherwise you just use the SSL key if that's all you have. After that I haven't explored it further. The advantage of an SSL key is that they usually must have one, it's secure, and they can't prevent people from using it.
    - tptacek 16y ago
      Vendors who don't provide some secure channel to send findings to are already subject to vigilante-style disincentives: if you don't provide a key, researchers will drop zero day on you publicly. Remember, public drops used to be the primary way things got disclosed. You appear to think we need to worry about vendors gaming the system. But on the researcher side, the standard definition of "responsible disclosure" is, "I wait 60 days after I send you something and then I go public whether you say OK or not". That isn't just my take on the situation; it's what actually happens.
      - zedshaw 16y ago
        It's starting to look like doing this for open source projects is a good start. They seem to be less capable at this, try to hide the vulnerabilities more, and reporting to them is much harder and well organized. Also, based on my experiences with how the Ruby projects does it's bullshit security, the users could really benefit. Thanks for your input Thomas.

I wonder how easy it is inside a corporation to get access to the SSL private key? I'm guessing a company like Microsoft doesn't hand that out to their developers easily.

jerf 16y ago

You would essentially proxy the request over to ops for decryption. That's how we handle GPG-encrypted vulnerability reports in the company I work for. We don't have out the private key to everybody, I think only two people have it, and they forward back the decrypted result internally to a security mailing list. The first couple of times you tried I would expect a general "WTF?" response from ops (indeed they should ask some pointed questions and not just immediately comply), but once you got over that it wouldn't be hard to put a process in place to deal with this routinely.

tptacek 16y ago
Or, instead of building a process for getting your ops team to do unusual things with your site certificate, you could just put up the web page with your GPG key on it.
- zedshaw 16y ago
  Yes, ideally GPG would be better, but if you only did GPG then companies could simply not publish a key and avoid the whole system. I'm envisioning some combination whereby, if they are already registered on vulnarb.com then you just get their GPG key (hopefully signed by their SSL key), otherwise you just use the SSL key if that's all you have. After that I haven't explored it further. The advantage of an SSL key is that they usually must have one, it's secure, and they can't prevent people from using it.
  - tptacek 16y ago
    Vendors who don't provide some secure channel to send findings to are already subject to vigilante-style disincentives: if you don't provide a key, researchers will drop zero day on you publicly. Remember, public drops used to be the primary way things got disclosed. You appear to think we need to worry about vendors gaming the system. But on the researcher side, the standard definition of "responsible disclosure" is, "I wait 60 days after I send you something and then I go public whether you say OK or not". That isn't just my take on the situation; it's what actually happens.
    - zedshaw 16y ago
      It's starting to look like doing this for open source projects is a good start. They seem to be less capable at this, try to hide the vulnerabilities more, and reporting to them is much harder and well organized. Also, based on my experiences with how the Ruby projects does it's bullshit security, the users could really benefit. Thanks for your input Thomas.