linuxdcpp-team team mailing list archive

[Quicksilver <991342@xxxxxxxxxxxxxxxxxx>]

I would really like it if we would go with KISS in ADCS and KEYP.
As in require hubs and clients to solely use self signed certs.

But others might have had some nice application in mind with certificate chains... still i am thinking that doing security any more complicated than it needs to be will bite us in the end.
Or am I way behind reality and that is already the case in current spec?

-- 
You received this bug notification because you are a member of
Dcplusplus-team, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/991342

Title:
  KEYP Vulnerability

Status in DC++:
  In Progress

Bug description:
  With the current vulnerability with DC++'s current KEYP implementation
  the underlying issue seems to be this ...

  [2012-04-26 09:24] <Crise> anyways, the thing with keyp is entirely
  different problem... which is basically that it only verifies keyp on
  the peer level certificate and not on the whole chain as it should

  Crise has stated he has another source who knows the exploit but will
  not divulge in who he is.

To manage notifications about this bug go to:
https://bugs.launchpad.net/dcplusplus/+bug/991342/+subscriptions