Robby Pedrica's Tech Blog

Tag: OpenID

  • OpenID and SSL/DNS poisoning

    —

    by

    Robby Pedrica
    in

    Ben Laurie of Google’s Applied Security team, while working with an external researcher, Dr. Richard Clayton of the Computer Laboratory, Cambridge University, found that various OpenID Providers (OPs) had TLS Server Certificates that used weak keys, as a result of the Debian Predictable Random Number Generator (CVE-2008-0166). In combination with the DNS Cache Poisoning issue…