Entries tagged as taz
berlin 129a 1mai 23c3 24c3 27c3 a100 abgeordnetenhaus akongress akw allianz almaty anarchiekongress antiatom asia asia2013 atheismus atomkraft autobahn bahnhof belene bild brandenburg bundestagunited bus buskampagne bz ccc cellular china compiz copyright creativecommons dataretention datenschutz demonstration dose elephantsdream energie energietisch energiewende erlian freeculture freedomnotfear freesoftware freifunk freiheitstattangst frequencies frequency fsfe gott gsm informationsfreiheit itu journey jugendumweltbewegung jukss kamera kameraüberwachung kazakhstan kernkraft klima klimaschutz klimawandel kohle kohlekraft kongress königswusterhausen kyoto lessig linux mcplanet mobilephones moleculeman moscow musik ökologie ökostrom openbsc openbts openstreetmap osm osmocombb papst peterschaar petropavl piratenpartei poland polizeigewalt preise privacy privatsphäre ratzinger re-publica re-publica09 religion rp09 rwe science security sony springer strom stromnetz tagebaue theory thermen topberlin train transsiberian travel travelling treptow tuberlin überwachung ubuntu umwelt umweltschutz unserwasser urgewald verkehr videoüberwachung volksbegehren vorratsdatenspeicherung wahl warsaw wasser wg wiki windowsxp wiretapping wirklimaretter wos wos4 yining youtube zensur zimmer cccamp11 certificate openleaks ssl transvalid algorithm android browser ca cacert certificateauthority cloudflare cryptography dell edellroot eff encryption facebook hash https maninthemiddle observatory openssl privatekey pss rsa sha1 sha256 superfish symantec tls updates vulnerability x509 fracing ifg informationsfreiheitsgesetz shalegas umweltinformationsgesetz 0days addresssanitizer adguard adobe aead aes afra aiglx altushost antivir antivirus aok apache apt asan auskunftsanspruch axfr azure badkeys barcamp bash berserk bias bigbluebutton bleichenbacher blog bodensee botnetz braunschweig bsi bsideshn bufferoverflow bugbounty bundesdatenschutzgesetz bundestrojaner bundesverfassungsgericht busby bypass c cbc cfb chcounter chrome chromium clamav clang clickjacking cmi cms code conflictofinterest cookie crash crypto csrf cve darmstadt deb debian deolalikar diffiehellman dingens diploma diplomarbeit distributions dns domain drupal easterhegg email english eplus fedora fileexfiltration firefox firewall fortigate fortinet forwardsecrecy freak freewvs ftp fuzzing gajim gallery gcc gentoo ghost gimp git glibc gnupg gnutls gobi google gpg gsoc gstreamer hackerone hacking hannover heartbleed helma http infoleak informationdisclosure internetscan ircbot itsecurity jabber javascript jodconverter joomla karlsruhe kaspersky key keyexchange komodia leak libreoffice luckythirteen malware mantis math md5 memorysafety mephisto microsoft milleniumproblems mitm modulobias moodle mozilla mpaa mplayer mrmcd mrmcd100b mrmcd101b multimedia mysql napster nessus netfiltersdk newspaper nist nss ntp ntpd onlinedurchsuchung openpgp openvas otr owncloud packagemanagement padding panda papierlos password passwordalert passwort passwörter pdo pgp phishing php pnp poodle privdog protocolfilters provablesecurity python rand random rc2 redhat rhein rpm rsapss rss s9y salinecourier schlüssel serendipity server session sha2 sha512 shellbot shellshock sicherheit signatures slides smime snallygaster sni sniffing spam sqlinjection squirrelmail staatsanwaltschaft stacktrace study stuttgart subdomain sunras support talk thesis tlsdate toendacms unicef unicode update useafterfree userdir utf-8 verschlüsselung virus vlc vortrag vulnerabilities web webapps webmontag websecurity wiesbaden windows wordpress xgl xine xmpp xsa xss zerodays zugangsdaten zzuf calendar cccamp cccamp15 certificates ipv6 letsencrypt libressl nginx ocsp ocspstapling openbsd planet revocation stadtmitte bilder lotus lotuseffekt natur wassertropfen
Friday, August 12. 2011
OpenLeaks doing strange things with SSL
OpenLeaks is a planned platform like WikiLeaks, founded by ex-Wikileaks member Daniel Domscheit-Berg. It's been announced a while back and a beta is currently presented in cooperation with the newspaper taz during the Chaos Communication Camp (where I am right now).I had a short look and found some things noteworthy:
The page is SSL-only, any connection attempt with http will be forwarded to https. When I opened the page in firefox, I got a message that the certificate is not valid. That's obviously bad, although most people probably won't see this message.
What is wrong here is that an intermediate certificate is missing - we have a so-called transvalid certificate (the term "transvalid" has been used for it by the EFF SSL Observatory project). Firefox includes the root certificate from Go Daddy, but the certificate is signed by another certificate which itself is signed by the root certificate. To make this work, one has to ship the so-called intermediate certificate when opening an SSL connection.
The reason why most people won't see this warning and why it probably went unnoticed is that browsers remember intermediate certificates. If someone ever was on a webpage which uses the Go Daddy intermediate certificate, he won't see this warning. I saw it because I usually don't use Firefox and it had a rather fresh configuration.
There was another thing that bothered me: On top of the page, there's a line "Before submitting anything verify that the fingerprints of the SSL certificate match!" followed by a SHA-1 certificate fingerprint. Beside the fact that it's english on a german page, this is a rather ridiculous suggestion. Checking a fingerprint of an SSL connection against one you got through exactly that SSL connection is bogus. Checking a certificate fingerprint doesn't make any sense if you got it through a connection that was secured with that certificate. If checking a fingerprint should make sense, it has to come through a different channel. Beside that, nowhere is explained how a user should do that and what a fingerprint is at all. I doubt that this is of any help for the targetted audience by a whistleblower platform - it will probably only confuse people.
Both issues give me the impression that the people who designed OpenLeaks don't really know how SSL works - and that's not a good sign.
Saturday, February 12. 2011
Berlin: Morgen mit "Ja" abstimmen
Ich hatte vor einer Weile schon für das Volksbegehren zur Offenlegung der Berliner Wasserverträge hier geworben.Zwischenzeitlich hat es einige Entwicklungen gegeben. Die notwendigen Unterschriften wurden gesammelt, wenige Tage später veröffentlichte die taz die Verträge im Internet. Dadurch wurden die meisten Befürchtungen, die vorher nur auf Gerüchten basierten, bestätigt.
Doch das Volksbegehren bezog sich nicht nur auf die Verträge über die Berliner Wasserversorgung. Es soll ganz generell Transparenz über Verträge zwischen der öffentlichen Hand und privaten Firmen herrschen. Weiterhin sollen Verträge, die nicht veröffentlicht werden, auch nicht gültig sein. Die Details sind etwas komplexer, wer sich für näheres interessiert, darf gerne die umfangreiche Webseite des Berliner Wassertischs besuchen.
Weswegen ich eigentlich schreibe: Der Volksentscheid hierüber findet morgen (Sonntag) statt - und alle BerlinerInnen, die hier mitlesen, möchte ich auffordern, hinzugehen und mit "Ja" zu stimmen.
Update: Ich lag mit dem was ich da geschrieben (und nun durchgestrichen) habe wohl nicht ganz richtig (sorry, habe mich unzureichend informiert) - tatsächlich bezog sich das Volksbegehren »nur« auf die Wasserverträge. Außerdem: Nach aktuellem Stand war der Volksentscheid erfolgreich!