Why doesn't BlackHatWorld use https?

[Banned member 185991]

https means fuck all, lets be honest.

The only reason half of you worry about it is Google came out and admitted it's one of their 15 thousand ranking factors.

 

[qrazy]

You can't get plaintext traffic out of SSL unless:

a) You have a 0-day crypto attack on the underlying encryption scheme (you don't)
b) You have a means of generating a trusted certificate (you don't)

That's it. What you are thinking of works by "downgrading" to HTTP. That assumes that a) the target site uses http as well as https and b) the user will not notice the padlock missing

I meant using a SSL interceptor like Bluecoat ProxySG which allows you to get decrypted content. There are other security suites which does this as well, even though they mainly use it for legit purposes of analyzing traffic.

 

[jazzc]

I meant using a SSL interceptor like Bluecoat ProxySG which allows you to get decrypted content. There are other security suites which does this as well, even though they mainly use it for legit purposes of analyzing traffic.

They install a root certificate in the employees computers via network group policies. I.e. they make their own certificate as trusted on the user computers. Then the proxy decrypts and resigns the traffic in order to read it. No root certificate installed, no decryption.

 

[qrazy]

They install a root certificate in the employees computers via network group policies. I.e. they make their own certificate as trusted on the user computers. Then the proxy decrypts and resigns the traffic in order to read it. No root certificate installed, no decryption.

Exactly. I know that, but people still think that using SSL is absolutely secure.

 

[Reaver]

I heard that HTTPS and BHW used to be an item, but then HTTPS started getting all this attention from Google. BHW isn't down with the Big G so it told HTTPS to choose which one she wanted. And, just like every whore, she ran off with the guy with the most money.

Now she's got millions of kids sucking off her pancake tits. And BHW is moving on to bigger and better things.

 

[Nut-Nights]

They install a root certificate in the employees computers via network group policies. I.e. they make their own certificate as trusted on the user computers. Then the proxy decrypts and resigns the traffic in order to read it. No root certificate installed, no decryption.

Well i didn't understand anything.

 

[jazzc]

Well i didn't understand anything.

SSL is a trust based pyramid scheme. Your pc/browser contains a small number of certificates from organizations that they deem trusted. Those are the "root" certificates. When a site owner buys an SSL certificate, he does not get it directly from them, but from a reseller of shorts (who themselves bought the ability to create certificates from a reseller etc). So there is a chain of trust that your browser checks in order to establish a valid SSL session. That's done cryptographically. If all the chain is verified as secure, the browser knows it's ok.

What companies do is that they add an extra trusted certificate on their employees computers. That extra root certificate is created by them, so they can create a valid SSL certificate for say gmail.com and decrypt the traffic. But it is only valid on the computers that have that extra certificate installed. In the computers that don't have it, the chain cannot get verified for the handmade gmail.com certificate.

 

[Nut-Nights]

SSL is a trust based pyramid scheme. Your pc/browser contains a small number of certificates from organizations that they deem trusted. Those are the "root" certificates. When a site owner buys an SSL certificate, he does not get it directly from them, but from a reseller of shorts (who themselves bought the ability to create certificates from a reseller etc). So there is a chain of trust that your browser checks in order to establish a valid SSL session. That's done cryptographically. Is all the chain is verified as secure, the browser knows it's ok.

What companies do is that they add an extra trusted certificate on their employees computers. That extra root certificate is created by them, so they can create a valid SSL certificate for say gmail.com and decrypt the traffic. But it is only valid on the computers that have that extra certificate installed. In the computers that don't have it, the chain cannot not get verified for the handmade gmail.com certificate.

Thats easy to understand.

 

[DrPorn]

HTTPS is used to make "man in the middle" attacks impossible. Anyone evesdropping between a user and the Internet would just see what appears to be random data. It is infact encrypted data, and can't be decrypted unless you have the correct key. Attempting to crack it would take so many years that it's considered impossible.

Whether or not BHW should be using SSL is subjective. I use SSL on everything, regardless, because its good practice and because I can But that's just me.

 

[jazzc]

is infact encrypted data, and can't be decrypted unless you have the correct key.

The important detail here is that there are hundreds of legitimate "master keys" out there that can be used to generate a valid key for a MITM scenario.

 

[DrPorn]

The important detail here is that there are hundreds of legitimate "master keys" out there that can be used to generate a valid key for a MITM scenario.

I don't follow. What do you mean by this?

MITM is only possible if the server key has been stolen, the client trusts an untrustworthy CA, or a fake CA hsa been injected. There's also SSLStrip that can be used in MITM attacks but that's a different story.

I'm not aware of any master keys that are available to be used to generate keys.

 

[pressrelease]

i just checked warriorforum also dont use https, now suggest what to do.

 

[jazzc]

I don't follow. What do you mean by this?

MITM is only possible if the server key has been stolen, the client trusts an untrustworthy CA, or a fake CA hsa been injected. There's also SSLStrip that can be used in MITM attacks but that's a different story.

I'm not aware of any master keys that are available to be used to generate keys.

A CA is a CA because it has a root certificate. Each root certificate can be used to create a totally legit certificate for any site. That done, it is trivial to MITM succesfully (replace the original valid certificate with the new also valid certificate on the fly).

What's more, a root certificate can be used to create other certificates that have exactly the same abilities. There is no way to track either how many of those super powerful certificates exist, nor track their generation, nor block them proactively, nor pretty much do anything other than trust them*.

According to EFF, there were ~650 CAs trusted (directly or indirectly) by Mozilla or Microsoft in 2010 (the estimate comes from ...scraping the web). In case you're thinking about the rigorous security measures etc. let me just point out the Google revoked Symantec's root key from Chrome (and Firefox followed too) in 2015 after discovering that Symantec had authored rogue SSL certs for hundreeds of domains including Google and Opera.

In other words: SSL as it is implemented is good enough to prevent the random neighborhood hax0r from sniffing your traffic, but that's all.

* kinda - things are starting to change with some new policies but for the purposes of this discussion assume that's exact.

 

[JustUs]

They install a root certificate in the employees computers via network group policies. I.e. they make their own certificate as trusted on the user computers. Then the proxy decrypts and resigns the traffic in order to read it. No root certificate installed, no decryption.

Don't want to start a pissing contest. If SSL were secure then the various security agencies, and alphabet agencies, such as the GHCQ, the NSA, the CIA, the DIA, the CCDCOE, GCHQ, (or any of these Wikipedia agencies: https://en.wikipedia.org/wiki/List_of_intelligence_agencies ) and the like would all have SSL encryption listed as a cyber weapon and prohibited from export.

 

[Eternal1912]

A CA is a CA because it has a root certificate. Each root certificate can be used to create a totally legit certificate for any site. That done, it is trivial to MITM succesfully (replace the original valid certificate with the new also valid certificate on the fly).

What's more, a root certificate can be used to create other certificates that have exactly the same abilities. There is no way to track either how many of those super powerful certificates exist, nor track their generation, nor block them proactively, nor pretty much do anything other than trust them*.

According to EFF, there were ~650 CAs trusted (directly or indirectly) by Mozilla or Microsoft in 2010 (the estimate comes from ...scraping the web). In case you're thinking about the rigorous security measures etc. let me just point out the Google revoked Symantec's root key from Chrome (and Firefox followed too) in 2015 after discovering that Symantec had authored rogue SSL certs for hundreeds of domains including Google and Opera.

In other words: SSL as it is implemented is good enough to prevent the random neighborhood hax0r from sniffing your traffic, but that's all.

* kinda - things are starting to change with some new policies but for the purposes of this discussion assume that's exact.

In simple words - is https a minus or a plus for BHW and does the forum need it?