http://simonwillison.net/2008-12-30T15:27:33+00:00Simon Willison2008-12-30T15:27:33+00:002008-12-30T15:27:33+00:00https://simonwillison.net/2008/Dec/30/fake/#atom-tag

<p><strong><a href="http://www.freedom-to-tinker.com/blog/felten/researchers-show-how-forge-site-certificates">Researchers Show How to Forge Site Certificates</a></strong></p> Use an MD5 collision to create two certificates with the same hash, one for a domain you own and another for amazon.com. Get Equifax CA to sign your domain’s certificate using the outdated “MD5 with RSA” signing method. Copy that signature on to your home-made amazon.com certificate to create a fake certificate for Amazon that will be accepted by any browser. <p>Tags: <a href="https://simonwillison.net/tags/collisions">collisions</a>, <a href="https://simonwillison.net/tags/ed-felten">ed-felten</a>, <a href="https://simonwillison.net/tags/equifaxca">equifaxca</a>, <a href="https://simonwillison.net/tags/hashes">hashes</a>, <a href="https://simonwillison.net/tags/md5">md5</a>, <a href="https://simonwillison.net/tags/security">security</a>, <a href="https://simonwillison.net/tags/ssl">ssl</a></p>