Hi, CloudFlare has a very interesting article on their attempts to get a SSL private key, explaining why they find it very unlikely to be able to get it. Here it is: http://blog.cloudflare.com/answering-the-critical-question-can-you-get-private-ssl-keys-using-heartbleed
On Fri, Apr 11, 2014 at 10:45 AM, Paul Vixie <p...@redbarn.org> wrote: > > > Juergen Christoffel wrote: > > On Thu, Apr 10, 2014 at 11:32:21PM -0700, Paul Vixie wrote: > >> [...] > >> really bruce? on a scale of doesn't-matter-at-all to > >> worst-thing-you-could-have-previously-imagined, a read only exploit is > >> even worse than that? > > > > With all due respect to your ego Paul, I think you might > > under-estimate the > > long term effects: private keys get stolen, this allows people to play > > man-in-the-middle, people (the masses) will renew their certificates but > > might re-use their generated private keys because the don't know exactly > > what they are doing, etc. > > thanks for whatever respect may be due, but bruce is still wrong. the > cost to fix this is: > > 1. replace all private keys > 2. replace all passwords > 3. upgrade all SSL software > > that rates 9 out of 10, where 10 is the worst thing i could have > imagined pre-heartbleed, which is remote file modification and/or remote > code execution, because the costs in that case would be: > > 1. inclusive of [1..3] above > 2. replace all operating systems > 3. audit or replace all user data > > > As the EFF's traces back into 2013 might tell us, some bad guys exploited > > this for some time now. If this is the case, we might soon arrive at the > > conclusion that we need to exchange all certificates which had been > > created > > in the last two years. > > we already have to do that, since we have to assume the worst whenever > we don't have log files which somehow prove a negative. > > > > > While I hope it tends to your interpretation, I fear a bit that it > > might be > > Bruces in the long run. > > bruce was spouting nonsense. heartbleed's costs will not be higher than > previously imaginable. > > vixie > > _______________________________________________ > Sent through the Full Disclosure mailing list > http://nmap.org/mailman/listinfo/fulldisclosure > Web Archives & RSS: http://seclists.org/fulldisclosure/ > -- Manuel Tiago Pereira _______________________________________________ Sent through the Full Disclosure mailing list http://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
