X-Git-Url: http://git.vanrenterghem.biz/git.ikiwiki.info.git/blobdiff_plain/058e7e451c3291b201d95f95101dabb1b4d2a5f0..1f7f5d5e0e21920c5f15290cd34594ad91077071:/doc/bugs/ssl_certificates_not_checked_with_openid.mdwn diff --git a/doc/bugs/ssl_certificates_not_checked_with_openid.mdwn b/doc/bugs/ssl_certificates_not_checked_with_openid.mdwn index e3bd56cfd..2dc74a984 100644 --- a/doc/bugs/ssl_certificates_not_checked_with_openid.mdwn +++ b/doc/bugs/ssl_certificates_not_checked_with_openid.mdwn @@ -40,7 +40,7 @@ For now, I want to try and resolve the issues with net\_ssl\_test, and run more >> -- Brian May >>> I guess that the place to add SSL cert checking would be in either ->>> [[cpan LWPx::ParanoidAgent]] or [[cpan Net::OpenID::Consumer]]. Adding +>>> [[!cpan LWPx::ParanoidAgent]] or [[!cpan Net::OpenID::Consumer]]. Adding >>> it to ikiwiki itself, which is just a user of those libraries, doesn't >>> seem right. >>> @@ -50,3 +50,19 @@ For now, I want to try and resolve the issues with net\_ssl\_test, and run more >>> that the SSL cert is issued by a trusted party and matches the domain name >>> of the site being connected to. I also don't personally think that SSL >>> certs are the right fix for DNS poisoning issues. --[[Joey]] + +I was a bit vague myself on the details on openid. So I looked up the standard. +I was surprised to note that they have already considered these issues, in +section 15.1.2, . + +It says: + +"Using SSL with certificates signed by a trusted authority prevents these kinds of +attacks by verifying the results of the DNS look-up against the certificate. Once +the validity of the certificate has been established, tampering is not possible. +Impersonating an SSL server requires forging or stealing a certificate, which is +significantly harder than the network based attacks." + +With regards to implementation, I am surprised that the libraries don't seem to +do this checking, already, and by default. Unfortunately, I am not sure how to test +this adequately, see . -- Brian May