1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
|
Received: from sog-mx-4.v43.ch3.sourceforge.com ([172.29.43.194]
helo=mx.sourceforge.net)
by sfs-ml-1.v29.ch3.sourceforge.com with esmtp (Exim 4.76)
(envelope-from <gmaxwell@gmail.com>) id 1VplJD-0003kL-Pi
for bitcoin-development@lists.sourceforge.net;
Sun, 08 Dec 2013 20:50:35 +0000
Received-SPF: pass (sog-mx-4.v43.ch3.sourceforge.com: domain of gmail.com
designates 209.85.192.175 as permitted sender)
client-ip=209.85.192.175; envelope-from=gmaxwell@gmail.com;
helo=mail-pd0-f175.google.com;
Received: from mail-pd0-f175.google.com ([209.85.192.175])
by sog-mx-4.v43.ch3.sourceforge.com with esmtps (TLSv1:RC4-SHA:128)
(Exim 4.76) id 1VplJD-00085E-48
for bitcoin-development@lists.sourceforge.net;
Sun, 08 Dec 2013 20:50:35 +0000
Received: by mail-pd0-f175.google.com with SMTP id w10so3955408pde.34
for <bitcoin-development@lists.sourceforge.net>;
Sun, 08 Dec 2013 12:50:29 -0800 (PST)
MIME-Version: 1.0
X-Received: by 10.68.52.202 with SMTP id v10mr4143712pbo.118.1386535829214;
Sun, 08 Dec 2013 12:50:29 -0800 (PST)
Received: by 10.70.81.170 with HTTP; Sun, 8 Dec 2013 12:50:29 -0800 (PST)
In-Reply-To: <CANAnSg2tep2VURmudfNModuJAryw8hfOj8Z8idVbt37keiZ8Lg@mail.gmail.com>
References: <52A3C8A5.7010606@gmail.com>
<1795f3067ba3fcdd0caf978cc59ff024.squirrel@fruiteater.riseup.net>
<52A435EA.7090405@gmail.com> <201312081237.24473.luke@dashjr.org>
<CANAnSg2OrmQAcZ+cZdtQeADicH3U29QOgYPfP1AQhOMP6+P1wg@mail.gmail.com>
<CAAS2fgR0khyJxmz9c2Oc87hOFgiNuiPJuaeugGajdo_EcKEW9w@mail.gmail.com>
<CANAnSg2tep2VURmudfNModuJAryw8hfOj8Z8idVbt37keiZ8Lg@mail.gmail.com>
Date: Sun, 8 Dec 2013 12:50:29 -0800
Message-ID: <CAAS2fgT=0m=0-C+MNotUy6nqwcR-Y+YTNYrS8DZptMo5vCMRnA@mail.gmail.com>
From: Gregory Maxwell <gmaxwell@gmail.com>
To: Drak <drak@zikula.org>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
X-Spam-Score: -1.6 (-)
X-Spam-Report: Spam Filtering performed by mx.sourceforge.net.
See http://spamassassin.org/tag/ for more details.
-0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/,
no trust [209.85.192.175 listed in list.dnswl.org]
-1.5 SPF_CHECK_PASS SPF reports sender host as permitted sender for
sender-domain
0.0 FREEMAIL_FROM Sender email is commonly abused enduser mail provider
(gmaxwell[at]gmail.com)
-0.0 SPF_PASS SPF: sender matches SPF record
0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked.
See
http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
for more information. [URIs: zikula.org]
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
author's domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature,
not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
X-Headers-End: 1VplJD-00085E-48
Cc: Bitcoin Dev <bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] Dedicated server for bitcoin.org,
your thoughts?
X-BeenThere: bitcoin-development@lists.sourceforge.net
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: <bitcoin-development.lists.sourceforge.net>
List-Unsubscribe: <https://lists.sourceforge.net/lists/listinfo/bitcoin-development>,
<mailto:bitcoin-development-request@lists.sourceforge.net?subject=unsubscribe>
List-Archive: <http://sourceforge.net/mailarchive/forum.php?forum_name=bitcoin-development>
List-Post: <mailto:bitcoin-development@lists.sourceforge.net>
List-Help: <mailto:bitcoin-development-request@lists.sourceforge.net?subject=help>
List-Subscribe: <https://lists.sourceforge.net/lists/listinfo/bitcoin-development>,
<mailto:bitcoin-development-request@lists.sourceforge.net?subject=subscribe>
X-List-Received-Date: Sun, 08 Dec 2013 20:50:35 -0000
On Sun, Dec 8, 2013 at 12:40 PM, Drak <drak@zikula.org> wrote:
> Let me clarify. SSL renders BGP redirection useless because the browser
> holds the signatures of CA's it trusts: an attacker cannot spoof a
> certificate because it needs to be signed by a trusted CA: that's the poi=
nt
> of SSL, it encrypts and proves identity, the latter part is what thwarts
> MITM. If there was an MITM the browser screams pretty loudly about it wit=
h a
> big threat warning interstitial.
Sadly this isn't true: There are (many) CAs which will issue a
certificate (apparently sometime within minutes, though last
certificate I obtained took a couple hours total) to anyone who can
respond to http (not https) requests on behalf of the domain from the
perspective of the CA.
This means you can MITM the site, pass all traffic through except the
HTTP request from the CA, and start intercepting once the CA has
signed your certificate. This works because the CA does nothing to
verify identity except check that the requester can control the site.
If you'd like to me to demonstrate this attack for you I'd be willing=E2=80=
=94
I can provide a proxy that passes on :80 and :443, run your traffic
through it and I'll get a cert with your domain name.
I'm sorry for the tangent here=E2=80=94 I think this sub-discussion is real=
ly
unrelated to having Bitcoin.org behind SSL=E2=80=94 but "someone is wrong o=
n
the internet", and its important to know that SSL hardly does anything
to reduce the need to check the offline signatures on the binaries.
|
