4 ms·

MitM on a self-signed certificates costs more than QUANTUM-style packet races. Please, stop trying to keep the internet in plaintext.

by pdkl95 11y ago

dogma1138 11y ago
I'm not trying to keep the internet in plain text, I'm trying to keep the internet a place where i can trust the certificates and not having to worry about a CA in china issuing certificates for the sites i visit because they can be CBA to check. An attack against a self signed cert may cost more then what ever but that wasn't what we were talking about initially either. If you can MITM which they can and can get cheap valid certificates it's game over. And while the NSA might be able to get certificates no matter the case, people have managed to buy certificates for domains they do not own multiple times now. Which puts the ability to MITM real world SSL sessions in the hands of individuals.
- pdkl95 11y ago
  > I'm trying to keep the internet a place where i can trust the certificates That ship sailed a long time ago. While hierarchical PKI has always been a flawed concept (I find it unlikely that you actually trust all of the organizations that firefox/etc ship as trusted roots). Even if you did, as you aid, these "authorities" have signed improper certs. Trying to patch holes in this failed system (such as revoking those improper certs) is yet another foolish attempt to enumerate badness[1]. If you want authentication, you need do your own chain-of-trust instead of assuming ~100 cert authorities will do that for you. > Which puts the ability to MITM real world SSL sessions in the hands of individuals. So we should keep the world in plaintext (by not allowing self signed certs)? Quite a few people besides the NSA already[2] MITM connections. My point is that we absolutely need to raise those costs. Even with the NSA, just because they have the capability to do something doesn't mean you should give up. Make the do the extra work of a MitM attck (even if probably a small amount of extra work in the case of the NSA). Add another categorization if you want. Nobody said you have to treat self-signed certs as secure, just that they need to be used. Privacy from eavesdroppers and authentication are separate goals. [1] http://www.ranum.com/security/computer_security/editorials/dumb/ http://www.ranum.com/security/computer_security/editorials/d... [2] https://projectbullrun.org/surveillance/2015/video-2015.html#bernstein https://projectbullrun.org/surveillance/2015/video-2015.html...
  - dogma1138 11y ago
    I think we are mostly in agreement, but the problem is that if the attacker can perform a MITM attack then a self signed certificate unless it's explicitly verified is worth less. I've said that we need to add additional levels of trust to the current PKI/SSL cert system preferably adding DNS records with the hash of the certificates and enforcing DNSSec globally this isn't the best solution but it's just enough of an easy hack that it will work for a good while. What i do not want to see is people thinking that if we just spam SSL certs and stick them on everything it will some how help us, this is the classical definition of security theater. When cost reduction isn't sufficient to thwart any effective surveillance, and worse using self signed certs trains people to just click accept, and free SSL certificates make it easier to gain valid certificates in a fraudulent manner things will only become worse not better. While it's true that authentication and encryption are separate domains with how TLS/SSL is implemented currently they are tied by the hip, if you can't trust the authentication part of SSL the encryption part becomes meaningless to all but the most primitive types of passive sniffing. If you want to separate them then lets kill TLS all together since PKI for the most part have failed, we can use other pure key exchange mechanism like well implemented DH without all the certificate nonsense.
    - pdkl95 11y ago
      > self signed certificate unless it's explicitly verified is worth less. Of course it's worth less; the point is that it's not worthless, and has greater value than plaintext. > if the attacker can perform a MITM attack Then you communication is still protected from other attackers. > What i do not want to see is people thinking that if we just spam SSL certs and stick them on everything That's exactly the thing that needs to happen. PHK was right when he pointed dout that it would be trivial for Apache to simply generate a self-signed cert on first use if no other cert exists, removing a lot of the plaintext on the the internet. > it will some how help us "some how"? The point was it provides very good protection against passive analytics (aka "eavesdropping", "spying"). > this is the classical definition of security theater. Nonsense, nobody has ever claimed self-signed certificates were "safe", we only said they were better than plaintext. Why would you accept self-signed certificates as any kind of authentication? > self signed certs trains people to just click accept sigh That dialog may be the biggest reason we're still using plaintext. I needs to die yesterday, for the very reason you say: it gives people bad habits. That kind of scary popup needs to be reserved for invalid certificates, which actually warrant that kind of attention. Given BULLRUN's large budget and how easy it is to manipulate software projects[1], it is somewhat suspicious that there just happens to be a scary popup if someone tries to encrypt without caring about authentication. Nobody said anything about giving self-signed certificates any kind of trust. This is about removing plaintext. Unfortunately, there has been culture that badly confuses authentication with encryption (privacy) when they are entirely separate matters. > meaningless to all but the most primitive types of passive sniffing. Which is exactly the set of problems I'm talking about. Why do you want to continue allowing passive sniffing? We can trivially put a stop to this kind of nearly-free eavesdropping, but because those solutions don't address more complicated types of attacks (by design! use authentication when you can!), security people tend to be hostile to the idea. Meanwhile, as the search for a perfect solution continues, incredible amounts of passive sniffing is de facto accepted as the status quo. [1] https://www.youtube.com/watch?v=fwcl17Q0bpk https://www.youtube.com/watch?v=fwcl17Q0bpk

MitM on a self-signed certificates costs more than QUANTUM-style packet races. Please, stop trying to keep the internet in plaintext.

by pdkl95 11y ago

MitM on a self-signed certificates costs more than QUANTUM-style packet races. Please, stop trying to keep the internet in plaintext.

dogma1138 11y ago

I'm not trying to keep the internet in plain text, I'm trying to keep the internet a place where i can trust the certificates and not having to worry about a CA in china issuing certificates for the sites i visit because they can be CBA to check. An attack against a self signed cert may cost more then what ever but that wasn't what we were talking about initially either. If you can MITM which they can and can get cheap valid certificates it's game over. And while the NSA might be able to get certificates no matter the case, people have managed to buy certificates for domains they do not own multiple times now. Which puts the ability to MITM real world SSL sessions in the hands of individuals.

pdkl95 11y ago
> I'm trying to keep the internet a place where i can trust the certificates That ship sailed a long time ago. While hierarchical PKI has always been a flawed concept (I find it unlikely that you actually trust all of the organizations that firefox/etc ship as trusted roots). Even if you did, as you aid, these "authorities" have signed improper certs. Trying to patch holes in this failed system (such as revoking those improper certs) is yet another foolish attempt to enumerate badness[1]. If you want authentication, you need do your own chain-of-trust instead of assuming ~100 cert authorities will do that for you. > Which puts the ability to MITM real world SSL sessions in the hands of individuals. So we should keep the world in plaintext (by not allowing self signed certs)? Quite a few people besides the NSA already[2] MITM connections. My point is that we absolutely need to raise those costs. Even with the NSA, just because they have the capability to do something doesn't mean you should give up. Make the do the extra work of a MitM attck (even if probably a small amount of extra work in the case of the NSA). Add another categorization if you want. Nobody said you have to treat self-signed certs as secure, just that they need to be used. Privacy from eavesdroppers and authentication are separate goals. [1] http://www.ranum.com/security/computer_security/editorials/dumb/ http://www.ranum.com/security/computer_security/editorials/d... [2] https://projectbullrun.org/surveillance/2015/video-2015.html#bernstein https://projectbullrun.org/surveillance/2015/video-2015.html...
- dogma1138 11y ago
  I think we are mostly in agreement, but the problem is that if the attacker can perform a MITM attack then a self signed certificate unless it's explicitly verified is worth less. I've said that we need to add additional levels of trust to the current PKI/SSL cert system preferably adding DNS records with the hash of the certificates and enforcing DNSSec globally this isn't the best solution but it's just enough of an easy hack that it will work for a good while. What i do not want to see is people thinking that if we just spam SSL certs and stick them on everything it will some how help us, this is the classical definition of security theater. When cost reduction isn't sufficient to thwart any effective surveillance, and worse using self signed certs trains people to just click accept, and free SSL certificates make it easier to gain valid certificates in a fraudulent manner things will only become worse not better. While it's true that authentication and encryption are separate domains with how TLS/SSL is implemented currently they are tied by the hip, if you can't trust the authentication part of SSL the encryption part becomes meaningless to all but the most primitive types of passive sniffing. If you want to separate them then lets kill TLS all together since PKI for the most part have failed, we can use other pure key exchange mechanism like well implemented DH without all the certificate nonsense.
  - pdkl95 11y ago
    > self signed certificate unless it's explicitly verified is worth less. Of course it's worth less; the point is that it's not worthless, and has greater value than plaintext. > if the attacker can perform a MITM attack Then you communication is still protected from other attackers. > What i do not want to see is people thinking that if we just spam SSL certs and stick them on everything That's exactly the thing that needs to happen. PHK was right when he pointed dout that it would be trivial for Apache to simply generate a self-signed cert on first use if no other cert exists, removing a lot of the plaintext on the the internet. > it will some how help us "some how"? The point was it provides very good protection against passive analytics (aka "eavesdropping", "spying"). > this is the classical definition of security theater. Nonsense, nobody has ever claimed self-signed certificates were "safe", we only said they were better than plaintext. Why would you accept self-signed certificates as any kind of authentication? > self signed certs trains people to just click accept sigh That dialog may be the biggest reason we're still using plaintext. I needs to die yesterday, for the very reason you say: it gives people bad habits. That kind of scary popup needs to be reserved for invalid certificates, which actually warrant that kind of attention. Given BULLRUN's large budget and how easy it is to manipulate software projects[1], it is somewhat suspicious that there just happens to be a scary popup if someone tries to encrypt without caring about authentication. Nobody said anything about giving self-signed certificates any kind of trust. This is about removing plaintext. Unfortunately, there has been culture that badly confuses authentication with encryption (privacy) when they are entirely separate matters. > meaningless to all but the most primitive types of passive sniffing. Which is exactly the set of problems I'm talking about. Why do you want to continue allowing passive sniffing? We can trivially put a stop to this kind of nearly-free eavesdropping, but because those solutions don't address more complicated types of attacks (by design! use authentication when you can!), security people tend to be hostile to the idea. Meanwhile, as the search for a perfect solution continues, incredible amounts of passive sniffing is de facto accepted as the status quo. [1] https://www.youtube.com/watch?v=fwcl17Q0bpk https://www.youtube.com/watch?v=fwcl17Q0bpk