MD5 Considered Harmful Today or Don't Put Too Much Faith in PKI

A group of 7 security researchers from the United States, Switzerland, and the Netherlands has released details of an exploitation ("MD5 considered harmful today") in the now well-known MD5 Hash Collision vulnerability that would allow a rogue web site to issue a rogue SSL certificate... as well as a rogue signing certificate that is trusted by a valid root Certificate Authority.

Putting that all into English (or at least non-geekspeak):

"Secure" web sites can be impersonated by evildoers, even with the cute little lock icon and a completely "valid" certificate as far as your browser is concerned. This web site could be your bank.

The paper discusses countermeasures, mostly aimed at Certificate Authorities (CAs) and browser vendors. One thing you can do is look at your certificate chain for critical sites to see if MD5 is used by the CA's signing certificate.

The Mozilla developers are already working on a patch for Firefox, et al.:
https://bugzilla.mozilla.org/show_bug.cgi?id=471539


--john

We cannot let this man be elected as President

I am appalled. If John McCain has done even one tenth of the things listed in this Rolling Stone article, we cannot let him take the office of the Commander in Chief:

http://tinyurl.com/3oje6n

Update:
Scary. Someone actually went to the trouble of breaking the above URL. Here is the new one:
http://tinyurl.com/mcmaverick

Or, just google for "mccain maverick rolling stone".

strip=1 ftw

I use lots of browser flame-retardant suit layers these days... NoScript, AdBlock, etc. I even tend to NoScript google.com by default. If you only go to "normal" web sites this might seem extreme, but if you are poking around the seedy back streets of the intertubes, you probably know what I mean.

Here is another good pair of tips for safer browsing:

1. Use the cache, Luke, and
2. Always use strip=1

You can use the google cache to search for your topic of interest, and the oracle will return some hits (e.g., "100th monkey"):

1. Hundredth Monkey Effect - Wikipedia, the free encyclopedia

   The “Hundredth Monkey Effect” is a supposed phenomenon in which a learned behaviour spreads instantaneously from one group of monkeys to all related monkeys ...
   en.wikipedia.org/wiki/Hundredth_Monkey - 32k - Cached - Similar pages - Note thisgqqw9kMHZRoFt8OyvG9JlHlDgwW5sgV299RIBg3DVr8DolLpJiLqsJelqosQMCWJe3ghxm2XTUvAtSU1k0AvRYTKu3ZWsO88HHco

2. The 100th Monkey Studio

   An open art studio using art therapy and creativity in Portland Oregon.
   www.the100thmonkeystudio.com/ - 14k - Cached - Similar pages - Note this

Then, click on the "Cached" link to view the page from the Google servers -- and avoid nastiness that might be found and the listed web sites themselves.

However...

That little trick doesn't completely protect you. Don't believe me? Just start up your favorite network sniffer (tcpdump, wireshark, etc.). You will see, if the page has certain types of content -- such as images, they will still come from the original web site. Oops! You have been identified, and hopefully not served.

The way to avoid this is to Right Click on that "Cached" link, past it into a browser's URL bar and add "&strip=1" to the end of it, such as...

http://www.google.com/search?q=cache:en.wikipedia.org\
/wiki/Hundredth_Monkey+100th+monkey&strip=1

Now your sniffer will happily report that all information comes only from Google.

Happy browsing!