3 ms·

Probably not a top concern for users, but this does look like it would be really difficult to use with HTTP Public Key Pinning unless Sandstorm were also keepin

Probably not a top concern for users, but this does look like it would be really difficult to use with HTTP Public Key Pinning unless Sandstorm were also keeping the pinning TTLs pretty short - which defeats the purpose. More info here if anyone's interested in HPKP: https://scotthelme.co.uk/hpkp-http-public-key-pinning/ https://scotthelme.co.uk/hpkp-http-public-key-pinning/

kentonv 11y ago
Honestly HPKP terrifies me. If you key is lost or compromised, you "brick" your site. How do you recover from the next Heartbleed? I think it could make sense to pin an offline key which is in turn used to sign online keys -- it's at least somewhat feasible to build secure, reliable storage for offline keys. But with current tech that would require that your offline key is a CA key, and as a regular user you have no ability to obtain such a certificate. So basically I don't think HPKP is a good idea, unless you are Google. I think certificate transparency is the most promising way forward here.
- Titanous 11y ago
  An offline signing key was proposed as TACK: http://tack.io http://tack.io Unfortunately HPKP was adopted by the browsers and TACK has gotten no traction with the vendors, despite being a more flexible system.
- tombrossman 11y ago
  It's true you can really DOS your own site if you don't follow best practices or have catastrophic data loss. Same with HSTS if you ever need to go back to HTTP. On balance, yours is a solid decision for your company and for typical users. Just pointing out a complication with something new people are starting to use. I've just started using it with a short TTL and several extra hashes I can fall back on in reserve. Works fine but I'm definitely not 'all in' yet. Edit: Also, if my understanding is correct you _do_ create an offline 'key' to generate hashes with a backup CSR, though this won't help if your machine (with the backup CSR used to generate a new key & recover from a server compromise) is also compromised.
- geofft 11y ago
  You can prepare the spare certificate in advance: generate two private keys (preferably with different software on different machines), buy two certs, and only put one of them online. That way, if something goes wrong, you have a known-working certificate you can switch to. It doubles the cost, which may or may not be worth the money. You're also allowed to pin any certificate in the chain, not just the end-entity cert (https://tools.ietf.org/html/rfc7469#section-2.6 https://tools.ietf.org/html/rfc7469#section-2.6), so you have some other options. You can pin some number of CAs that you think are trustworthy CAs: pin not only GlobalSign but a few other major CAs that you'd consider using in the future. That doesn't protect you from all the things HPKP could possibly protect you from, but it does protect you from the DigiNotars and MCS Holdings and TURKTRUSTs of the world.
  - blfr 11y ago
    You don't need to buy a spare cert in advance. You can use a a CSR, and only get it signed when necessary.
zimbatm 11y ago
Isn't it possible to pin the CA instead of the certificate ?

kentonv 11y ago

Honestly HPKP terrifies me. If you key is lost or compromised, you "brick" your site. How do you recover from the next Heartbleed? I think it could make sense to pin an offline key which is in turn used to sign online keys -- it's at least somewhat feasible to build secure, reliable storage for offline keys. But with current tech that would require that your offline key is a CA key, and as a regular user you have no ability to obtain such a certificate. So basically I don't think HPKP is a good idea, unless you are Google. I think certificate transparency is the most promising way forward here.

Titanous 11y ago
An offline signing key was proposed as TACK: http://tack.io http://tack.io Unfortunately HPKP was adopted by the browsers and TACK has gotten no traction with the vendors, despite being a more flexible system.
tombrossman 11y ago
It's true you can really DOS your own site if you don't follow best practices or have catastrophic data loss. Same with HSTS if you ever need to go back to HTTP. On balance, yours is a solid decision for your company and for typical users. Just pointing out a complication with something new people are starting to use. I've just started using it with a short TTL and several extra hashes I can fall back on in reserve. Works fine but I'm definitely not 'all in' yet. Edit: Also, if my understanding is correct you _do_ create an offline 'key' to generate hashes with a backup CSR, though this won't help if your machine (with the backup CSR used to generate a new key & recover from a server compromise) is also compromised.
geofft 11y ago
You can prepare the spare certificate in advance: generate two private keys (preferably with different software on different machines), buy two certs, and only put one of them online. That way, if something goes wrong, you have a known-working certificate you can switch to. It doubles the cost, which may or may not be worth the money. You're also allowed to pin any certificate in the chain, not just the end-entity cert (https://tools.ietf.org/html/rfc7469#section-2.6 https://tools.ietf.org/html/rfc7469#section-2.6), so you have some other options. You can pin some number of CAs that you think are trustworthy CAs: pin not only GlobalSign but a few other major CAs that you'd consider using in the future. That doesn't protect you from all the things HPKP could possibly protect you from, but it does protect you from the DigiNotars and MCS Holdings and TURKTRUSTs of the world.
- blfr 11y ago
  You don't need to buy a spare cert in advance. You can use a a CSR, and only get it signed when necessary.

zimbatm 11y ago

Isn't it possible to pin the CA instead of the certificate ?