Slashdot Mirror
Null-Prefix SSL Certificate For PayPal Released
An anonymous reader writes "Nine weeks after Moxie Marlinspike presented at Defcon 17, null-prefix certificates that exploit the SSL certificate vulnerability are beginning to appear. Yesterday, someone posted a null-prefix certificate for www.paypal.com on the full-disclosure mailing list. In conjunction with sslsniff, this certificate can be used to intercept communication to PayPal from all clients using the Windows Crypto API, for which a patch is still not available. This includes IE, Chrome, and Safari on Windows. What's worse, because of the OCSP attack that Moxie also presented at Defcon, this certificate cannot be revoked." Update: 10/06 23:19 GMT by KD: Now it seems that PayPal has suspended Marlinspike's account.
If you cause someone grief, don't expect them to be nice to you in return. That's just life. You can be as "correct" as you like, they still have the right to tell you to fuck off.
If you are an asshole to me, you'll find yourself banned from my house, my websites, etc, etc. Doesn't matter if you feel it was justified, or if you feel that you were "helping the world" with what you did. You cause me grief, you become persona non grata to me. I will not associate with you professionally or personally.
Same shit here. He's causing Paypal problems, and in fact will probably cost them business. I'm not surprised they aren't interested in doing business with him any more. He is well within his rights to publish about this vulnerability, they are well within their rights to refuse him service.
Fuck Macs.
Can you please tell us what exactly Paypal is going to do here? Seriously. WHAT. DO. YOU. THINK. PAYPAL. IS. GOING. TO. DO. ABOUT. A. BUG. IN. MICROSOFT'S. SOFTWARE?
If you want to make an analogy try this one:
Bob makes a walkway over a thousand foot drop and puts a nice rail on it.
Some twit, say, Cowymous Onward, comes along and says "if someone presses against this rail in just this place, in this peculiar body position, they can slip through and die."
Bob considers this and sits down to fix the problem in a robust and well thought out manner.
The next day, Cowymous Onward happens to be on the walkway and notes that it hasn't been fixed. In moment of absolute fucking brilliance, he decides to demonstrate the nature of the problem. He begins grabbing the school children, who happen to be visiting the walkway, and after twisting their arms back just so, and pushing their right leg out just like this, shoves them one by one through the railing to their death.
So tell me, who is the complete twat: The school children for using their last moments of life to think "gosh, that dude sure was an asshole." Or Cowymous Onward for deciding to cause substantial grief for an unrelated third party whose only "crime" was existing and being near the walkway.