bugtraq - Re: etax 2010 failure to validate remote ssl certificate properly

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Fri, 10 Sep 2010 01:09:21 +1000
From: dave b <db.pub.mail@...il.com>
To: bugtraq@...urityfocus.com
Subject: Re: etax 2010 failure to validate remote ssl certificate properly

On 8 September 2010 05:17, dave b <db.pub.mail@...il.com> wrote:
> On 8 September 2010 05:09, dave b <db.pub.mail@...il.com> wrote:
>> etax 2010[0]
>
> Minor edit :)
> "> (note: you need a certificate for _any_ domain signed by a CA"
> should be:
> "> (note: you need a certificate for a domain that has been signed by
> a signed by a CA installed on the client pc"
> i.e. a certificate for https://foo.com that works on the client :)

On a re-test with a fresh vm I found that it will accept any ssl cert,
regardless of being signed by $ca or not.
Sorry for the numerous lame emails :)
-- 
The naked truth of it is, I have no shirt.		-- William Shakespeare,
"Love's Labour's Lost"