5 ms·

The Downside of Encrypting Everything: Virus-Filled Ads Are Harder to Track

19 points by frostmatthew 11y ago

facetube 11y ago
IMO, look for increasing pressure on CAs to unilaterally revoke certificates issued to known malware networks.
- dogma1138 11y ago
  That won't happen, if anything SSL cert's are easier to get now than ever and with projects like letsencrypt.org it will become even easier. Also many of the malicious adds do not come from malware networks they come from all major ad networks including Google's. You have ads exploiting zero day vulnerabilities in Flash and browsers that not easy to detect, and with the amount of syndication in ad networks you can't effectively blacklist or revoke them. One of the downsides to this whole "letsencrypt" movement and CA's from less "organized" countries being accepted by major browsers and clients is that you will have much more failures in security. SSL was designed around high level of trust and that trust worthy SSL certificates will not be easy to come by, this is why they used to cost so much there was actual inspection and you would get fraud insurance for quite high amounts. Today i won't be surprised if you could get a Google.com cert from some low tier CA in the Philippines which automates the process and it will be valid on large amount of devices. We need a better verification system for SSL and actual policing of certificates including integrating it into DNS, if i ask for Google.com i should get a "cert" entry from the DNS server just as i get the A entry for it, and i don't understand why this isn't the case yet.
  - themartorana 11y ago
    Because the main thrust of HTTPS at this point is regaining some privacy from snooping governmental organizations more than it is building a trust chain.
    - dogma1138 11y ago
      So having a chaotic system in which SSL certificates are easy to near trivial to get and hence spoof makes it harder for organizations to spy on you?
      - Karunamon 11y ago
        In a manner of speaking. Even a self signed certificate prevents you from passive eavesdropping and traffic injection (a thing we know the US government is doing right now) if not an an active man in the middle (something which may or may not be happening to you on the plain HTTP connections you use every day)
        dogma1138 11y ago
        Passive eavesdropping yes, injection nope since it's not passive to begin with and unless you can explicitly verify it it's pretty useless. SSL works because we assume that people can't issue certificates for websites that they do not control which isn't the case.
        pdkl95 11y ago
        MitM on a self-signed certificates costs more than QUANTUM-style packet races. Please, stop trying to keep the internet in plaintext.
        dogma1138 11y ago
        I'm not trying to keep the internet in plain text, I'm trying to keep the internet a place where i can trust the certificates and not having to worry about a CA in china issuing certificates for the sites i visit because they can be CBA to check. An attack against a self signed cert may cost more then what ever but that wasn't what we were talking about initially either. If you can MITM which they can and can get cheap valid certificates it's game over. And while the NSA might be able to get certificates no matter the case, people have managed to buy certificates for domains they do not own multiple times now. Which puts the ability to MITM real world SSL sessions in the hands of individuals.
Khaine 11y ago
If we block ads, there isn't a problem
- ised 11y ago
  If sites start moving to HTTP/2, is it true the untrustworthy code can be inserted into the same stream as the "content"? Everything could be coming from the same domain/IP? This might make blocking ads and tracking more complicated? My solution as HTTPS spreads is to MITM my own connections so I can see what is being sent and received over the wire. As the article says, it is a PITA. But it is necessary.
- recursive 11y ago
  There are just different problems. If everyone were to block ads, they'd become harder to block. And some of the websites that rely on them would stop existing.
duskwuff 11y ago
Er... I'm not sure I see how having ad traffic travel over HTTPS is a problem here. Malware researchers deal with HTTPS all the time. It's not some sort of insurmountable barrier -- the content is all available to a browser, after all.
- dogma1138 11y ago
  Much of the traffic is sniffed off the wire because malware distributors are actively hiding from known bots and traffic cops.
- adricnet 11y ago
  The content is available after it is decrypted in a browser on a single host. If the streams are inspectable by network defenses they can be inspected at much more feasible scale allowing one device to protect 10,000s of hosts from the same malware-laden ad. The alternative is to try and deliver protection to 10,000 browsers, and somehow keep them synchronized which is just so much harder and expensive. Or you could make the host operating system, apps, and the browser resistant to exploitation... It's not that encrypting secrets is bad (and sessions are secrets). It's that encrypting everything without looking at what you gain and lose is poor engineering and it all seems to be politicized somehow (camps, factions, dogma..) with HTTPS-only being pushed as the answer to one security problem (confidentiality vs active eavesdroppers) at the expense of existing solutions to other problems, including integrity (please don't compromise my hosts), availability (I cannot use recent browsers to admin my equipment because they ban self-signed certs but trust 100+ CAs) and non-repudiation (where did the malware come from?). ... speaking as someone who studies malware analysis. Cheers, adric

19 points by frostmatthew 11y ago

facetube 11y ago

IMO, look for increasing pressure on CAs to unilaterally revoke certificates issued to known malware networks.

dogma1138 11y ago
That won't happen, if anything SSL cert's are easier to get now than ever and with projects like letsencrypt.org it will become even easier. Also many of the malicious adds do not come from malware networks they come from all major ad networks including Google's. You have ads exploiting zero day vulnerabilities in Flash and browsers that not easy to detect, and with the amount of syndication in ad networks you can't effectively blacklist or revoke them. One of the downsides to this whole "letsencrypt" movement and CA's from less "organized" countries being accepted by major browsers and clients is that you will have much more failures in security. SSL was designed around high level of trust and that trust worthy SSL certificates will not be easy to come by, this is why they used to cost so much there was actual inspection and you would get fraud insurance for quite high amounts. Today i won't be surprised if you could get a Google.com cert from some low tier CA in the Philippines which automates the process and it will be valid on large amount of devices. We need a better verification system for SSL and actual policing of certificates including integrating it into DNS, if i ask for Google.com i should get a "cert" entry from the DNS server just as i get the A entry for it, and i don't understand why this isn't the case yet.
- themartorana 11y ago
  Because the main thrust of HTTPS at this point is regaining some privacy from snooping governmental organizations more than it is building a trust chain.
  - dogma1138 11y ago
    So having a chaotic system in which SSL certificates are easy to near trivial to get and hence spoof makes it harder for organizations to spy on you?
    - Karunamon 11y ago
      In a manner of speaking. Even a self signed certificate prevents you from passive eavesdropping and traffic injection (a thing we know the US government is doing right now) if not an an active man in the middle (something which may or may not be happening to you on the plain HTTP connections you use every day)
      - dogma1138 11y ago
        Passive eavesdropping yes, injection nope since it's not passive to begin with and unless you can explicitly verify it it's pretty useless. SSL works because we assume that people can't issue certificates for websites that they do not control which isn't the case.
        pdkl95 11y ago
        MitM on a self-signed certificates costs more than QUANTUM-style packet races. Please, stop trying to keep the internet in plaintext.
        dogma1138 11y ago
        I'm not trying to keep the internet in plain text, I'm trying to keep the internet a place where i can trust the certificates and not having to worry about a CA in china issuing certificates for the sites i visit because they can be CBA to check. An attack against a self signed cert may cost more then what ever but that wasn't what we were talking about initially either. If you can MITM which they can and can get cheap valid certificates it's game over. And while the NSA might be able to get certificates no matter the case, people have managed to buy certificates for domains they do not own multiple times now. Which puts the ability to MITM real world SSL sessions in the hands of individuals.

Khaine 11y ago

If we block ads, there isn't a problem

ised 11y ago
If sites start moving to HTTP/2, is it true the untrustworthy code can be inserted into the same stream as the "content"? Everything could be coming from the same domain/IP? This might make blocking ads and tracking more complicated? My solution as HTTPS spreads is to MITM my own connections so I can see what is being sent and received over the wire. As the article says, it is a PITA. But it is necessary.
recursive 11y ago
There are just different problems. If everyone were to block ads, they'd become harder to block. And some of the websites that rely on them would stop existing.

duskwuff 11y ago

Er... I'm not sure I see how having ad traffic travel over HTTPS is a problem here. Malware researchers deal with HTTPS all the time. It's not some sort of insurmountable barrier -- the content is all available to a browser, after all.

dogma1138 11y ago
Much of the traffic is sniffed off the wire because malware distributors are actively hiding from known bots and traffic cops.
adricnet 11y ago
The content is available after it is decrypted in a browser on a single host. If the streams are inspectable by network defenses they can be inspected at much more feasible scale allowing one device to protect 10,000s of hosts from the same malware-laden ad. The alternative is to try and deliver protection to 10,000 browsers, and somehow keep them synchronized which is just so much harder and expensive. Or you could make the host operating system, apps, and the browser resistant to exploitation... It's not that encrypting secrets is bad (and sessions are secrets). It's that encrypting everything without looking at what you gain and lose is poor engineering and it all seems to be politicized somehow (camps, factions, dogma..) with HTTPS-only being pushed as the answer to one security problem (confidentiality vs active eavesdroppers) at the expense of existing solutions to other problems, including integrity (please don't compromise my hosts), availability (I cannot use recent browsers to admin my equipment because they ban self-signed certs but trust 100+ CAs) and non-repudiation (where did the malware come from?). ... speaking as someone who studies malware analysis. Cheers, adric