Vulnarb.com is an idea I've had for a while but only recently figured out how I might do it. The problem it solves is allowing security researchers to responsibly release vulnerabilities they find, but still publicly report that a company has a vulnerable product. Vulnarb.com will let them do this by:
The goal is to provide a market incentive for companies to fix security holes, rather than the current situation where they can sit on them legally for years. It's hoped that vulnarb.com will make specialized "corporation only" security mailing lists obsolete.
A secondary purpose will be to create a game for researchers or a social network or something else so that people can have fun doing this.
If you want to help out with this concept, then try out the following script against a site with a valid SSL key: encrypt.sh. What this script does (and look at it first) is:
It does all of this using standard OpenSSL command line tools and nothing more.
You'll want to download a list of the CA root certs, and easiest (but maybe not safest) is to get it from curl:
curl http://curl.haxx.se/ca/cacert.pem > cacert.pem
Once you have that, you run the script like this:
sh encrypt.sh www.google.com mysecrets.txt
You can run it multiple times for different sites, and the results end up in results/ so go look at what you get.
The next step is to create a decrypt script similar to the above which should do the following:
If you want to work on this, then tell me on twitter @zedshaw and I'll take a look at what you have.
Currently this is just a quick test that anybody can review to see if the idea would even work. The purpose of using SSL certificates as the public key crypto is so a researcher can publish a vulnerability without having to beg for PGP keys and such, or similar barriers to publishing.
Other than this it's currently just a concept and feel free to bring up potential issues with it.