[618] in Privacy_Forum
[ PRIVACY Forum ] Surveillance via bogus SSL certificates
daemon@ATHENA.MIT.EDU (privacy@vortex.com)
Wed Mar 24 16:13:48 2010
Date: Wed, 24 Mar 2010 12:53:44 -0700
To: privacy-list@vortex.com
Message-ID: <20100324195344.GC18876@vortex.com>
MIME-Version: 1.0
Content-Disposition: inline
From: privacy@vortex.com
Reply-To: PRIVACY Forum Digest mailing list <privacy@vortex.com>
Content-Type: text/plain; charset="iso-8859-1"
Errors-To: privacy-bounces+privacy-forum=mit.edu@vortex.com
Content-Transfer-Encoding: 8bit
----- Forwarded message from Dave Farber <dave@farber.net> -----
Date: Wed, 24 Mar 2010 15:34:27 -0400
From: Dave Farber <dave@farber.net>
Subject: [IP] Surveillance via bogus SSL certificates
Reply-To: dave@farber.net
To: ip <ip@v2.listbox.com>
Begin forwarded message:
> From: Matt Blaze <mab@crypto.com>
> Date: March 24, 2010 3:09:19 PM EDT
> To: Dave Farber <dave@farber.net>
> Subject: Surveillance via bogus SSL certificates
>
> Dave,
>
> For IP if you'd like.
>
> Over a decade ago, I observed that commercial certificate authorities
> protect you from anyone from whom they are unwilling to take money.
> That turns out to be wrong; they don't even do that.
>
> Chris Soghoian and Sid Stamm published a paper today that describes a
> simple "appliance"-type box, marketed to law enforcement and
> intelligence agencies in the US and elsewhere, that uses bogus
> certificates issued by *any* cooperative certificate authority to act as
> a "man-in-the-middle" for encrypted web traffic.
>
> Their paper is available at http://files.cloudprivacy.net/ssl-mitm.pdf
>
> What I found most interesting (and surprising) is that this sort of
> surveillance is widespread enough to support fairly mature, turnkey
> commercial products. It carries some significant disadvantages for
> law enforcement -- most particularly it can be potentially can be
> detected.
>
> I briefly discuss the implications of this kind of surveillance at http://www.crypto.com/blog/spycerts/
>
> Also, Wired has a story here: http://www.wired.com/threatlevel/2010/03/packet-forensics/
>
>
> -matt
>
>
>
-------------------------------------------
Archives: https://www.listbox.com/member/archive/247/=now
RSS Feed: https://www.listbox.com/member/archive/rss/247/
Powered by Listbox: http://www.listbox.com
----- End forwarded message -----
_______________________________________________
privacy mailing list
http://lists.vortex.com/mailman/listinfo/privacy
