<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Ben Laurie:
<blockquote
cite="mid:1b587cab0808080751s274c8a83iadd159aae8af7c6@mail.gmail.com"
type="cite">
<pre wrap="">On Fri, Aug 8, 2008 at 12:44 PM, Eddy Nigg (StartCom Ltd.)
<a class="moz-txt-link-rfc2396E" href="mailto:eddy_nigg@startcom.org"><eddy_nigg@startcom.org></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">This affects any web site and service provider of various natures. It's not
exclusive for OpenID nor for any other protocol / standard / service! It may
affect an OpenID provider if it uses a compromised key in combination with
unpatched DNS servers. I don't understand why OpenID is singled out, since
it can potentially affect any web site including Google's various services
(if Google would have used Debian systems to create their private keys).
</pre>
</blockquote>
<pre wrap=""><!---->
OpenID is "singled out" because I am not talking about a potential
problem but an actual problem.
</pre>
</blockquote>
<br>
Sorry Ben, but any web site or service (HTTP, SMPT, IMAP, SSH, VPN,
etc) which makes use of a compromised key has an actual problem and not
<b>a</b> potential problem. Open ID as a standard isn't more affected
than, lets say XMPP...If there are servers and providers relying on
such keys the have a real actual problem. I don't see your point about
Open ID nor didn't I see anything new....<br>
<br>
The problem of weak keys should be dealt at the CA level, many which
have failed to do anything serious about it.<br>
<br>
<blockquote
cite="mid:1b587cab0808080751s274c8a83iadd159aae8af7c6@mail.gmail.com"
type="cite">
<pre wrap="">
We have spotted other actual problems in other services. Details will
be forthcoming at appropriate times.
</pre>
</blockquote>
<br>
I think it's superfluous to single out different services since any
service making use of the weak keys is affected, with recent discovery
of DNS poisoning making the matter worse. I suggest you try a forum
which can potentially reach many CAs, they in fact have everything at
their disposal to remove this threat!<br>
<br>
<br>
<div class="moz-signature">
<table border="0" cellpadding="0" cellspacing="0">
<tbody>
<tr>
<td colspan="2">Regards </td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
<tr>
<td>Signer: </td>
<td>Eddy Nigg, <a href="http://www.startcom.org">StartCom Ltd.</a></td>
</tr>
<tr>
<td>Jabber: </td>
<td><a href="xmpp:startcom@startcom.org">startcom@startcom.org</a></td>
</tr>
<tr>
<td>Blog: </td>
<td><a href="http://blog.startcom.org">Join the Revolution!</a></td>
</tr>
<tr>
<td>Phone: </td>
<td>+1.213.341.0390</td>
</tr>
<tr>
<td colspan="2"> </td>
</tr>
</tbody>
</table>
</div>
<br>
<br>
</body>
</html>