U tweetove putem weba ili aplikacija drugih proizvođača možete dodati podatke o lokaciji, kao što su grad ili točna lokacija. Povijest lokacija tweetova uvijek možete izbrisati. Saznajte više
To clarify the Windows crypto fail: The problem isn't in signature validation. The problem is the *root store/cache*. CryptoAPI considers an (attacker-supplied) root CA to be in the trust store if its public key and serial match a cert in the root store, Ignoring curve params.
So the attacker provides a cert that gets cached. If that cert has a pub key and serial that matches one the user already has in his local root store, the attacker cert is trusted and used? Is crafting a cert like that possible? I'm assuming yes, or did I miss something?
The real cert gets cached, then the attacker cert masquerades as the cached cert and gets trusted. Yes, doing this is trivial and there is code on GitHub already. It's standard OpenSSL commands and a few lines of Python.
Awesome, thanks for the clarification.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.
