|
Posted by Nil on October 28, 2007, 5:36 am
If you were Registered and logged in, you could reply and use other advanced thread options
> What does a forged SSL situation look like to the user logging into
email?
> Do you have an example?
>
> I read with interest all the help kindly provided by the likes of helpful
> folks like VanguardLH & mark carter & others - which basically concluded
> Tor compromised mail login passwords under both circumstances
> - http (the Tor gets your mail password in the clear)
> - https (the Tor _could_ impersonate the "certificate")
>
> So, I ask ... how can I tell if a certificate is impersonated by a rogue
> Tor? I routinely say yes to all certificate requests because I never
> understood them. Now I will take the time to read them.
>
> But, what does a fake SSL situation look like?
Mainly, you can see one because it obfucates the microcode in your HOSTS
files. Another way is to log to HTTPS the source code (unless it is C#) to
a NON HTTPS website.
> For example, I just initiated a connection to my legimate router:
> https://192.168.1.1
> And it said (as it always does):
> "Security Error: Domain Name Mismatch"
> It went on:
> "You have attempted to establish a connection with 192.168.1.1.
> However, the security certificate presented belongs to Linksys.
> It is possible, though unlikely, that someone may be trying to
> intercept your communications with this web site.
> It gave the recommendation:
> "If you suspect the certificate shown does not belong to
> 192.168.1.1, please cancel the connection and notify the
> site administrator?
>
> Obviously this whole situation is a false alarm.
>
> Does anyone have an example of a situation we can go to in order to see
> what a "real" SSL forgery looks like to the user as they try to log into
> their email web site?
Sure, take this URL.
http://tinyurl.com/2tt98s
Then when it loads, do a quick, CTRL-ALT-ampersand. If Java is scripted
server side only, then you can see the talisman algorithms. If not, then
you have to look at the compiled (previous not present, prior to browser
time-outs or MITM attacks).Either way, you have your answer.
HTH
| 
XML site map