SSL Man-in-the-middle

Again a great "Security Now" podcast about SSL: how governments can sniff SSL traffic by enforcing Certificate Authorities to provide them with (intermediate CA) certificates. Based on this paper. Great story, recommended reading or listening!

Some things that I picked up:

• Different CA's can provide you with SSL certificate for same URL (or whatever)
• Internet Explorer (actually the Windows crypto) downloads extra CA's dynamically; so the list you see in IE can grow behind the scenes
• Firefox manages the list of trusted CA's itself
• There is no standard policy for when a CA is accepted by browser vendors
  
• The list of trusted CA's should be based on your geographical location
• Trusting a CA is somewhat equivalent to trusting a government
  
• Browser should provide (advanced) users with extra features to help them decide if CA certificate should be trusted or not

In my daytime job, SSL/TLS is used a lot for communication between IT systems within the corporate firewall or with business partners across the Internet. Low level configuration of SSL/TLS is often not supported:

• Configure single CA (or self-signed) cert to be trusted for specific outbound connection (e.g. when business partners have defined their "own CA")
• Different SSL client certificate per outbound connection
  
• Easy configuration revocation checks (OCSP etc); and checking if the revocation checks actually work
• Different timeout settings per connection
  
• Only accept SSL connections on specific interfaces
  

Shooter game or warfare?

Are my children playing Counterstike?
Or flying a drone plane over Afghanistan?
Great article about pilots flying unmanned planes with remote control. But really remote: 10.000+ kms away.

Claims explained

SAML, WS-Security and the Secure Token Service of WS-Trust result in a very interesting mix, where federated identity and integration (web services) come together.
Microsoft has published the free book(let) "A Guide to Claims–based Identity and Access Control". Obviously the book is focused on Microsoft technology, ADFS (code name Geneva), FAM and WIF in particular. But I found the first 2 chapters very informative and well written.

E.g. interesting to have confirmation that applications need to keep maintaining fine grained (data level) authorizations themselves.

Also intersting to read about the challenge of home realm discovery: how to know to what Identity provider an external user should be redirected to.

One of the main challenges in my opionion with federated identity is the transformation of tokens/claims. Unless there is further standardization (profiles), the integration with each external business partners will require token transformations. There seems to be a general tendency in WS-land not to bother too much with the actual business content of SOAP messages or SAML tokens.

The day when SAML tokens can be used in an interoperable manner to connect to back-end applications such as SAP or Oracle will be a great day. Looking forward to it.

Securing my laptop

In my car, I spend quite some time listening to podcasts. On the topic of security, the podcasts Security Now and the Dutch podcast "De beveiligingsupdate" are my favourites.

Driven by the suggestions in these podcasts, I have taken a few extra measures to secure my laptop:

1. Replace the ever leaky Adobe Acrobat PDF Reader with the Foxit reader.
2. Set the Security level in Microsoft Internet Explorer to High for every zone. Even when using another browser, IE is used in MS-Office applications.
3. Installed the NoScript plug-in in Firefox. NoScript allows to selectively allow the execution of Javascript. Only for a few sites I have allowed Java script permanently. For most sites, I only allow Javascript temporarily. It offers some extra defense against cross-site scripting attacks (XSS).

Disabling Javascript also helps with privacy: it reduces the amount of information exposed for browser fingerprinting. More Firefox add-ons for safer surfing are available here. Next one I'll try is Better Privacy to automatically remove Flash cookies.

B2B market keeps moving

As mentioned in the blog post of Gartner analyst Benoit Lheureux, the market of B2B products keeps moving, e.g. the acquisition of Foresight by Tibco.


Interesting blog post as well on the SAP Developer Network: SAP will increase its stake in Crossgate and SAP sales people will (re-)sell the Crossgate B2B service offering.

Note: I always confuse Crossgate and Northgate. NorthgateArinso is a SAP oriented provider of HR IT services and acquired the Belgian company Arinso.

Elie Crets

Elie Crets
22-mrt-1934 / 19-jan-2010

Do it yourself CA

Recently got questions on testing with certificates. Use self-signed certificates or CA signed certs? And how to easily obtain CA signed certs? It was quite a while ago that I had been playing with certs myself. So time to refresh my mind, do some searching + experimenting, and write a blog entry about it.

CA signed certificates (SSL server and client) are recommended as only the CA cert needs to be imported as a trusted certificate (e.g. in cacerts). First option is to use a free CA like CAcert.

Second option is to setup your own (test) CA. The most obvious option is to use openssl. The command line tool of openssl allows to first create a CA keypair + CA self-signed cert and next sign certificate requests (CSR), thereby creating CA signed certificates.

Alternative tools for a do-it-yourself CA with GUI are:

• EJBCA: runs on top of J2EE app server
• LigthCA: on top of OpenSSL
  
• SimpleAuthority: standalone Java app, includes Windows installer
  

Played around a bit with this SimpleAuthority, and it looks quite OK. One can import certficate signing requests and export signed cert. A very limited version is free, but to manage an unlimited number of certificates, the cost is $50 (personal) to $240 (commercial). The ease-of-use and consistency of the GUI could be improved, but it does do the job.

Notes:

• To generate and manage keystores, thé recommended tools is Portecle.
• Alternative is Keytool IUI: it has extra features such as signing of files, but less user friendly than Portecle.
• All sorts of links about PKI