“The NSA discovered an error in the Microsoft code that verifies those signatures, potentially enabling a hacker to forge the signature”https://www.washingtonpost.com/national-security/nsa-found-a-dangerous-microsoft-software-flaw-and-alerted-the-firm--rather-than-weaponize-it/2020/01/14/f024c926-3679-11ea-bb7b-265f4554af6d_story.html …
-
A big thing I've not found in any writeup is a list of which major browsers use the affected windows crypto libraries and are therefore also vulnerable to MITM attacks until you update windows. Firefox uses NSS - does that mean it is not susceptible? What about Chrome, Edge, etc?
Chrome uses the affected library. As do Edge and IE. To be honest, Firefox is the only Windows browser I'm aware of at the moment that rolls their own crypto.
-
-
I'm seeing Mozilla source that indications they use the "CertGetCertificateChain" function https://github.com/mozilla/gecko-dev/search?q=certgetcertificatechain&unscoped_q=certgetcertificatechain …
-
Indeed, but only for the optional (not on by default) enterprise root support feature. https://support.mozilla.org/en-US/kb/setting-certificate-authorities-firefox …
Kraj razgovora
Novi razgovor -
-
-
Thanks for the details. Obviously one should just patch right away, but it is interesting to know that if you need to use a web browser before you do patch, Firefox is the only safe choice. (You would need to already have it installed though
.)Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.