Hanno's blog

I recently held a workshop about cryptography for web developers at the company Internations. I am publishing the slides here.

Part 1: Crypto and Web [PDF] [LaTeX], [Slideshare]
Part 2: How broken is TLS? [PDF] [LaTeX], [Slideshare]
Part 3: Don't do this yourself [PDF] [LaTeX], [Slideshare]
Part 4: Hashing, Tokens, Randomness [PDF] [LaTeX], [Slideshare]
Part 5: Don't believe the Crypto Hype [PDF] [LaTeX] [Slideshare]

Part 2 is the same talk I recently have at the Easterhegg conference about TLS.

In the last weeks, I made a study research project at the EISS at the University of Karlsruhe. The subject was »Session Cookies and SSL«, investigating the problems that arise when trying to secure a web application with HTTPS and using session cookies.

I already wrote about this in the past, presenting vulnerabilities in various web applications.

One of the notable results is probably that ebay has just no measurements against those issues at all, so it's pretty trivial to hijack a session (and use that to do bids and even change the address of the hijacked account).

Download »Session Cookies and SSL« (PDF, 317 KB)

Yesterday I did some maintenance of our server configuration and wondered what would be the correct way to handle unconfigured virtual hosts. E. g. what http-response should come if someone just enters the IP of our server or a domain that just isn't used for http.

At the moment, we're shipping a html-page explaining that it's an unconfigured domain, which is probably okay, but we ship it with HTTP code 200 (which means »OK«). I thought it should probably ship with some kind of error code so that search engines know there's no real webpage.
Now, reading RFC 2616 (HTTP 1.1) didn't answer the question to me. Most near is probably a 404, others we considered were 403, 503 or 204, but non of them seems to really match that situation. Maybe I should write some enhancement request to the IETF...

Comments appreciated, what would you think would be the correct status.

I live in a dormitory where I get cheap and fast internet access, but http only through a proxy. It's a pity to set this up in all apps every time I come here and disable it again when I wanna get online somewhere else, cause there's no centralized point to do so (there are many apps out there that just ignore http_proxy env var).
Now, it wasn't possible to directly forward http requests to the dormitory proxy, because it misses some options required for that. Maybe it's possible with more iptables skills, would require http-header rewriting.

My solution was setting up a local squid, forward requests via iptables to that and configure the dormitory proxy as a parent. I found that there's a lot of documentation out there, but also lot's of outdated stuff (squid configuration options significantly changed) and stuff you won't understand if you are no proxy-guru.

Now, some lines in my squid.conf:
http_port 7777 transparent
visible_hostname 127.0.0.1
acl local src [myip]/255.255.255.255
http_access allow local
cache_peer proxy.mynetwork.com parent 3128 3130 proxy-only

First line enables all Options required to allow transparent http and sets the port to 7777 (can be anything, just shouldn't collide with any service you might run). visible_hostname is required, something that resolves to localhost. The acl and http_access lines will deny any requests from other hosts, and finally, cache_peer sets the upstream proxy (just replace proxy.mynetwork.com with whatever your network proxy is).
Beside, there's some line starting with hierarchy_stoplist, you need to comment that out, else it won't allow you to use urls with GET variables.

Now, for the iptables-part, it's pretty simple:
iptables -t nat -A OUTPUT -p tcp --dport 80 -j DNAT --to 127.0.0.1:7777

I've now added squid to my default runlevel, it doesn't take that long to start. My network setup scripts contain above iptables-line for the dormitory and the squid is just ignored elsewhere. One problem though I haven't debugged enough to know the cause is that sometimes it seems to be unable to deliver POST vars, e. g. the function search of php.net doesn't work.

For your info, my system is Gentoo Linux with squid 2.6.9, iptables 1.3.7 and kernel 2.6.20.