security - Is it secure to check a self-signed certificate based on it's fingerprint? -


i develop small system consisting of embedded server (including small display) , mobile devices (at moment android phones).

these mobile devices should able talk embedded server on secure channel. purpose, server generates self-signed ssl certificate during first boot process.

if new mobile device should connected server, server displays qr code consisting of:

  • server ip
  • ssl certificate fingerprint
  • random device id

the user scans qr code using mobile device. mobile device connects server , checks whether ssl certificate fingerprint matches 1 scanned before.

is considered secure? if not, how solve problem?

an alternative approach:

on very-first boot, server generates certificate request , sends central ca server signs certificate. client devices has installed ca certficate , verifies server certificate against it.

however, send certificate request ca server , signed certificate. (one propably implement authentication ca server using "master key" once extracted system image, whole authentication becomes useless). in addition setup requires central server avoid since product may used in "offline" environment.

yes, considered secure because fingerprint of server's certificate transferred client via trusted mechanism (being physically next server receive fingerprint via difficult tamper transport mechanism). if mitm attack attempted after initial setup, though server name same, different keys have been generated fingerprint different , client detect , can appropriately reject communication.

it argued method more secure because client not need trust 3rd party verify authenticity of certificate. cas issue fraudulent certificates.


Comments

Post a Comment

Popular posts from this blog

basic authentication with http post params android -

i doing basic authentication passing username , password , using basicnamevaluepair sending post params response service. my method: public stringbuilder callservicehttppost(string username, string password, string type) { // create new httpclient , post header httpclient httpclient = new defaulthttpclient(); httppost httppost = new httppost(webservice + type); httpresponse response = null; stringbuilder total = new stringbuilder(); try { url url = new url(webservice + type); /*string base64encodedcredentials = base64.encodetostring((username + ":" + password).getbytes(), base64.url_safe | base64.no_wrap);*/ string base64encodedcredentials = "basic " + base64.encodetostring( (username + ":" + password).getbytes(), base64.no_wrap); httppost.setheader("auth...
Read more

vb.net - Virtual Keyboard commands -

i wondering difference between virtual these keyboard commands is: keyeventf_extendedkey , keyeventf_keyup is. everywhere have looked gives me description based off integers , not want know each of them does. you've tagged question vb.net, these have nothing @ vb.net. they're constants defined in windows header files, use win32 api functions. as far difference, can't tell looking @ values. individual values not particularly important, that's why named identifiers used. what's important used , documentation functions tells mean. the first one, keyeventf_extendedkey , used keybdinput structure (which used along e.g. sendinput function) pass information synthesized keyboard input. if flag used, means scan code should interpreted extended key. technically, means scan code preceded prefix byte value 224 (&he0 in hexadecimal notation). the second one, keyeventf_keyup , 1 of flags available use structure. means key being released (going up)...
Read more

css - Firefox for ubuntu renders wrong colors -

Image
i've got following problem: i'm developing website, while testing around i've noticed firefox , chromium display css bar in different colors. when switched between several machine come conclusion firefox ubuntu problem. on other devices i've tested website. it's fine. the differences between chrome , firefox rendering: firefox: chromium: note: firefox ubuntu problem. does knows why , came solution? https://bugzilla.mozilla.org/show_bug.cgi?id=655637 bug 629312 - firefox displays wrong colors on image (only linux) open about:config , rechange gfx.color_management.mode 2 0.
Read more