Re: hardware security module storing x509 client cert: mozilla code for loging into subversion

2007-09-09 Thread Nelson Bolyard
rupert thurner wrote: > we noticed that the support for hardware security modules (smartcards) > storing ssl client certificates in mozilla/firefox is quite good. > > is it possible to somehow reuse this for serf to provide x509 client > certificate login for subversion, via the serf library? D

Re: [Full-disclosure] Firefox 2.0.x: tracking unsuspecting users using TLS client certificates

2007-09-09 Thread Peter Besenbruch
Brendan Dolan-Gavitt wrote: > Can anyone see if this works through Privoxy and the other things in the > standard Tor bundle? It works with Tor with, and without Privoxy. -- Hawaiian Astronomical Society: http://www.hawastsoc.org HAS Deepsky Atlas: http://www.hawastsoc.org/deepsky __

Re: [Full-disclosure] Firefox 2.0.x: tracking unsuspecting users using TLS client certificates

2007-09-09 Thread Erik Tews
Am Freitag, den 07.09.2007, 10:04 -0400 schrieb Arshad Noor: > Alex, > > Do you presume that the websites in the domains that you intend > to track users will install the self-signed CA certificate that > issued the client-certificate to the unsuspecting user? If not, > how will the browser know

Re: [Full-disclosure] Firefox 2.0.x: tracking unsuspecting users using TLS client certificates

2007-09-09 Thread Brendan Dolan-Gavitt
It occurs to me that this could be used to good effect to track someone using Tor across various domains you control. Most Tor users know to kill JS, Flash, and are more than normally paranoid about cookies, but may not think twice about accepting a client certificate. I'm CC'ing the Tor mailing li

Re: Personal crypto device (or smart card) success stories?

2007-09-09 Thread Eddy Nigg (StartCom Ltd.)
Hi Kyle, This is a very interesting and extensive piece and I'm sure that no one gets offended here. Opinions are important in order to learn! Pleaser allow me some comments (without offense ;-)) Kyle Hamilton wrote: > have you ever tried to use signed > messages via Outlook Express over Hotm