Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: InfoSec Handlers Diary Blog - SANS Internet Storm Center InfoSec Handlers Diary Blog

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Oh, just click "yes"

Published: 2011-02-04
Last Updated: 2011-02-04 01:09:56 UTC
by Daniel Wesemann (Version: 1)
5 comment(s)

Java and Java Applets are featuring prominently on my "annoyances list" this year. There are vulnerabilities aplenty, and incompatibilities keep many a firm or university from applying the patches. We've covered these to some extent.

The latest incarnation of annoyance though is commercial software applets that are signed with an expired certificate. Dear vendors, if your "release" is supported until 2013, it is a bad idea to sign the code of said release with a cert that expires in December 2010. And it is an even worse idea to suggest to clients who open a ticket that they should just tell their users to "click yes" on the certificate warning until a patch can be provided.

The Original Sin of certificate handling in Java and Web Browsers alike?

The "oh, connect anyway" button.

I sure wish it simply weren't there.


Keywords: certificate java
5 comment(s)
Diary Archives