4 ms·
Quite a lot of languages let's you do https, but just give you illusion of security. Not really validating it, which is trivial to spoof with certificate signed
by jakozaur 12y ago
Quite a lot of languages let's you do https, but just give you illusion of security. Not really validating it, which is trivial to spoof with certificate signed by "your own authority".
"The Most Dangerous Code in the World:
Validating SSL Certificates in Non-Browser Software"
https://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf https://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
- idbehold 12y agoWow, does this imply that the Heartbleed bug might end up being even more damaging that previously thought? This paper shows that even if you've already revoked your old certs, many pieces of widely used software don't even bother validating them.
- ossreality 12y agoYes. Like Chrome. And Android devices. And more. Yes, this is why Heartbleed is/was bad.
- Eridrus 12y agoThis has nothing to do with heartbleed. This means you can just generate certs on your own machine that a lot of software will simply accept.
- deleted 12y ago[deleted]