[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAJYVuzm_e6sLuQmxX2OXxgVg0z=YS-A6PMvu4UT1N5ULycbwCw@mail.gmail.com>
Date: Fri, 30 Jan 2015 14:27:24 -0500
From: TingPing <tingping@...gping.se>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: xchat/hexchat don't properly verify
SSL certificates
If anybody cares, HexChats plan is to support cert-pinning so users can
still trust self-signed certs. Eitherway this has little to do with
validating hostnames, especially self-signed certs should always have
matching hostnames.
On Fri, Jan 30, 2015 at 9:15 AM, Kurt Seifried <kseifried@...hat.com> wrote:
> On 30/01/15 02:56 AM, Michael Samuel wrote:
> > On 30 January 2015 at 06:24, Sam Dodrill <shadow.h511@...il.com> wrote:
> >> A lot of the time IRC networks will not pay for a verified SSL cert due
> to
> >> the fact that the kind of SSL cert they would need (a wildcard one) is
> >> financially prohibitive. I don't think this is a security bug with
> hexchat
> >> more a symptom of the fact that SSL combines encryption and identity
> >> verification where sometimes people only want the former.
> >
> > The correct response to this is for them to publish their self-signed
> > certificate (or even a CA certificate) and have it pasted into the
> > client, along with the configuration.
>
> Sorry what? A DV (Domain Validated) wildcard cert is now 80-90$ a year
> from many providers (google "cheap ssl"). SSL certs are no longer
> expensive and have not been for many years.
>
> > The client could then perform a byte-wise compare of the public key.
> >
> > I assume well-known networks could have their certificates hard-coded
> > into the client.
>
> No. Just no. You put root certs on the client side, not the actual
> server certs. Google "crypto agility" and so on.
>
> --
> Kurt Seifried -- Red Hat -- Product Security -- Cloud
> PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
>
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
