> -----Original Message-----
> From: David P. Donahue [mailto:ddonahue@xxxxxxxxxxx]
> Sent: Montag, 13. März 2006 17:14
> To: users@xxxxxxxxxxxxxxxx
> Subject: Re: [users@httpd] SSL And Virtual Hosts
>
>
> The most we're talking about here is a username/password for
> forums/ftp/webmail. I definitely don't have the
> infrastructure in place
> for any serious e-commerce sites, nor would I want that kind of
> responsibility placed on my home business at this stage.
>
> I'm curious, though, about your cautionary statements. In what way
> could this setup potentially be abused? Assume that the only
> people who
> use any SSL-encrypted services on my secondary domains are
> fully aware
> of my primary domain and know that I am the one handling
> their hosting.
> Thus, when they receive a warning message about their certificate,
> they'd see my name and know it's OK. Is there a way for a
> 3rd party to
> abuse this and hijack their data?
You obviously know your own application and are aware of the risks; I'm talking about HTTPS in general.
Generally speaking, it is possible for an attacker to intercept traffic and route it to his own server. If you use a self-signed certificate or tell clients to ignore browser-warnings, the spoof server can similarly use a self-signed cert and so set an encrypted channel. The client then has a conversation with the attacker, thinking it is with the target site.
Certificate authentication is based on the premise that only the target site *possesses* the authenticated certificate. So only when connected to the target site does the host name (typed in by the client) match the common-name (encoded in the cert).
You're adding a layer of social engineering on top of HTTPS ("...they'd see my name and know it's OK...") which helps a bit - it's up to you whether you think the risks are low enough. To help decide, ask yourself; "What's the worst thing that could happen if an attacker got hold of someone's account details?"
>
> The only thing I can think of is if someone messed with their DNS so
> that they go to another server pretending to be me. But, even with
> authentication, the only way to truly prevent that would be to use
> "trusted" certs, which cost, what, $200? (something I don't
> have at the
> moment)
Basically, correct.
> As long as I'm self-signing, anyone can self-sign
> and pretend
> to be me.
Exactly.
For more background reading, browse around in www.wikipedia.org - start with "authentication" and follow links therein...
Rgds,
Owen Boyle
Disclaimer: Any disclaimer attached to this message may be ignored.
>
>
> Regards,
> David P. Donahue
> ddonahue@xxxxxxxxxxx
> http://www.cyber0ne.com
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP
> Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
> " from the digest: users-digest-unsubscribe@xxxxxxxxxxxxxxxx
> For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx
>
>
Diese E-mail ist eine private und persönliche Kommunikation. Sie hat keinen Bezug zur Börsen- bzw. Geschäftstätigkeit der SWX Gruppe. This e-mail is of a private and personal nature. It is not related to the exchange or business activities of the SWX Group. Le présent e-mail est un message privé et personnel, sans rapport avec l'activité boursière du Groupe SWX.
This message is for the named person's use only. It may contain confidential, proprietary or legally privileged information. No confidentiality or privilege is waived or lost by any mistransmission. If you receive this message in error, please notify the sender urgently and then immediately delete the message and any copies of it from your system. Please also immediately destroy any hardcopies of the message. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. The sender's company reserves the right to monitor all e-mail communications through their networks. Any views expressed in this message are those of the individual sender, except where the message states otherwise and the sender is authorised to state them to be the views of the sender's company.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
" from the digest: users-digest-unsubscribe@xxxxxxxxxxxxxxxx
For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx
|