6 items tagged “edfelten”
2008
Researchers Show How to Forge Site Certificates. Use an MD5 collision to create two certificates with the same hash, one for a domain you own and another for amazon.com. Get Equifax CA to sign your domain’s certificate using the outdated “MD5 with RSA” signing method. Copy that signature on to your home-made amazon.com certificate to create a fake certificate for Amazon that will be accepted by any browser.
Popular Websites Vulnerable to Cross-Site Request Forgery Attacks. Ed Felten and Bill Zeller announce four CSRF holes, in ING Direct, YouTube, MetaFilter and the New York Times. The ING Direct hole allowed transfer of funds out of a user’s bank accounts! The first three were fixed before publication; the New York Times hole still exists (despite being reported a year ago), and allows you to silently steal e-mail addresses by CSRFing the “E-mail this” feature.
2007
Radiohead Album Available for Free, But Fileshared Anyway. “Why are some people getting In Rainbows from P2P rather than the band’s site? Probably because they find P2P easier to use.”
E-Voting Ballots Not Secret; Vendors Don’t See Problem. “You know things are bad when questions about a technical matter like security are answered by a public-relations firm.”
Once people see that a pretty good phone can be a pretty good mobile computer, they won’t settle for less anymore; and mobile networks will be pried open.
HBO Exec Wants to Rename DRM. “... until recently nobody had complained that the term ’Digital Rights Management’ was insufficiently Orwellian.”