Comments on: Another Protocol Bites The Dust http://www.links.org/?p=780 Ben Laurie blathering Fri, 27 Aug 2010 13:41:58 +0000 http://wordpress.org/?v=2.9.2 hourly 1 By: Links » TLS Renegotiation, 7 Months On http://www.links.org/?p=780&cpage=1#comment-367103 Links » TLS Renegotiation, 7 Months On Wed, 09 Jun 2010 08:18:50 +0000 http://www.links.org/?p=780#comment-367103 [...] been 7 months since the TLS renegotiation problem went public and Opera’s security group have a couple of interesting articles about it. The [...] [...] been 7 months since the TLS renegotiation problem went public and Opera’s security group have a couple of interesting articles about it. The [...]

]]> By: Links » Extended Subsets http://www.links.org/?p=780&cpage=1#comment-344067 Links » Extended Subsets Thu, 17 Dec 2009 16:38:43 +0000 http://www.links.org/?p=780#comment-344067 [...] dealing with the recent SSL fun, I met Marsh Ray, who found the problem in the first place. Marsh has a website, [...] [...] dealing with the recent SSL fun, I met Marsh Ray, who found the problem in the first place. Marsh has a website, [...]

]]> By: 78% of most popular HTTPS are still vulnerable « onlinesecurityblog.info http://www.links.org/?p=780&cpage=1#comment-341298 78% of most popular HTTPS are still vulnerable « onlinesecurityblog.info Thu, 03 Dec 2009 17:28:36 +0000 http://www.links.org/?p=780#comment-341298 [...] Laurie of Google was working on the renegotiation flaw around six weeks before it was made public, so it is perhaps unsurprising that 7 of the 24 safe sites are owned by [...] [...] Laurie of Google was working on the renegotiation flaw around six weeks before it was made public, so it is perhaps unsurprising that 7 of the 24 safe sites are owned by [...]

]]> By: операционные системы Linux/BSD » В протоколах SSL/TLS найдена критическая уязвимость http://www.links.org/?p=780&cpage=1#comment-337586 операционные системы Linux/BSD » В протоколах SSL/TLS найдена критическая уязвимость Wed, 11 Nov 2009 06:52:38 +0000 http://www.links.org/?p=780#comment-337586 [...] реализаций протокола. Для OpenSSL уже выпущен временный патч (дополнение: исправления представлены в GnuTLS 2.8.5 и OpenSSL [...] [...] реализаций протокола. Для OpenSSL уже выпущен временный патч (дополнение: исправления представлены в GnuTLS 2.8.5 и OpenSSL [...]

]]> By: NetStorming » Seria vulnerabilidad en SSL http://www.links.org/?p=780&cpage=1#comment-337095 NetStorming » Seria vulnerabilidad en SSL Sun, 08 Nov 2009 01:50:40 +0000 http://www.links.org/?p=780#comment-337095 [...] un post en Slashdot, una grave vulnerabilidad en el protocolo SSL podría permitir ataques de man-in-the-middle durante [...] [...] un post en Slashdot, una grave vulnerabilidad en el protocolo SSL podría permitir ataques de man-in-the-middle durante [...]

]]> By: Fallo de seguridad SSL y TLS | El mundo de IMD http://www.links.org/?p=780&cpage=1#comment-337033 Fallo de seguridad SSL y TLS | El mundo de IMD Sat, 07 Nov 2009 14:46:43 +0000 http://www.links.org/?p=780#comment-337033 [...] en Slashdot una noticia que se está extendiendo como la pólvora: se trata de una vulnerabilidad bastante seria en SSL. Resumidamente, se trata de un clásico man-in-the-middle que podría explotar la renegociación de [...] [...] en Slashdot una noticia que se está extendiendo como la pólvora: se trata de una vulnerabilidad bastante seria en SSL. Resumidamente, se trata de un clásico man-in-the-middle que podría explotar la renegociación de [...]

]]> By: В протоколах SSL/TLS найдена критическая уязвимость » Боталка http://www.links.org/?p=780&cpage=1#comment-337025 В протоколах SSL/TLS найдена критическая уязвимость » Боталка Sat, 07 Nov 2009 12:11:46 +0000 http://www.links.org/?p=780#comment-337025 [...] реализаций протокола. Для OpenSSL уже выпущен временный патч, середыш которого сводится к пoлнoму отключению [...] [...] реализаций протокола. Для OpenSSL уже выпущен временный патч, середыш которого сводится к пoлнoму отключению [...]

]]> By: Barrapunto | Descubierta grave vulnerabilidad en SSL/TLS « El camello, el Leon y el niño. O la evolución del perro al lobo http://www.links.org/?p=780&cpage=1#comment-337020 Barrapunto | Descubierta grave vulnerabilidad en SSL/TLS « El camello, el Leon y el niño. O la evolución del perro al lobo Sat, 07 Nov 2009 10:50:15 +0000 http://www.links.org/?p=780#comment-337020 [...] cuenta: «Leo en Slashdot una noticia que se está extendiendo como la pólvora: se trata de una vulnerabilidad bastante seria en SSL. Resumidamente, se trata de un clásico man-in-the-middle que podría explotar la renegociación de [...] [...] cuenta: «Leo en Slashdot una noticia que se está extendiendo como la pólvora: se trata de una vulnerabilidad bastante seria en SSL. Resumidamente, se trata de un clásico man-in-the-middle que podría explotar la renegociación de [...]

]]> By: Anonymous Coward http://www.links.org/?p=780&cpage=1#comment-337001 Anonymous Coward Sat, 07 Nov 2009 05:42:17 +0000 http://www.links.org/?p=780#comment-337001 > OpenSSL is written by monkeys I think Linus specifically noted that the OpenBSD committers are a group of *masturbating* monkeys. i.e., they care about security~ > OpenSSL is written by monkeys

I think Linus specifically noted that the OpenBSD committers are a group of *masturbating* monkeys.

i.e., they care about security~

]]> By: David-Sarah Hopwood http://www.links.org/?p=780&cpage=1#comment-336993 David-Sarah Hopwood Sat, 07 Nov 2009 04:02:56 +0000 http://www.links.org/?p=780#comment-336993 In response to comment 7: CSRF is normally constrained to some extent by the same-origin policy; this isn't. In your example, the response to the img request can't be read by a script -- it can only be displayed (and if there were a way for an attacker to read the displayed pixels, that would be a browser bug). In response to comment 7:
CSRF is normally constrained to some extent by the same-origin policy; this isn’t. In your example, the response to the img request can’t be read by a script — it can only be displayed (and if there were a way for an attacker to read the displayed pixels, that would be a browser bug).

]]>