7 ms·

Why do we have to go through this whole SSL certificates thing and can't just have a simple, automatically secure, I-do-nothing-and-my-website-is-secure protoco

by oliv__ 11y ago

Why do we have to go through this whole SSL certificates thing and can't just have a simple, automatically secure, I-do-nothing-and-my-website-is-secure protocol? Seriously though. If secure is the default from now on, why can't it actually be the default?

aembleton 11y ago
Because you need to create a public key for the browser to use.
- rwmj 11y ago
  SSH gets this right -- create a host key when the server is installed, and have the client check the key and only warn/error when it changes. Sure, this isn't super-secure for first time visitors to their banking website or whatever, but those websites can continue to use the current system.
  - nothrabannosir 11y ago
    SSH doesn't get this right. It's no better than a (auto-pinned) self-signed cert, in our world. I challenge everyone to find in their extended group of friends and colleagues, and their friends and colleagues, a single person who consistently checks the fingerprint* on every first SSH connection. Id personally have a hard time finding someone who even knows it matters. And if you don't? Mitm can get your password, or tunnel your key to another host, bar some crazy ~/.ssh/config which nobody has. WiFi's WPA2 actually does this better than SSH; the passphrase authenticates both parties to eachother, not just one way. I can't set up a hotspot with your home SSID and intercept your PSK---even on initial connection. SSH: nice in a cryptographic utopia, not better than self signed SSL certs when applied to human beings. SSH is just not suitable for humans. Apparently. * a significant part of it, not just the security-through-obscurity random 2 letters in the middle and the last four.
    - ryanlol 11y ago
      -o VisualHostKey=yes
      - nothrabannosir 11y ago
        A band-aid, I'm afraid. Without going into the question of how many bits of entropy that actually has when used with human beings in real settings, and just assume it's a perfect check; my question stands: how many people can you find who use this? Many SSH clients don't even support it, at all. PuTTY and almost anything that uses SSH for tunneling. When they do: how many of your hosts do you know the image of? Again: nice idea, but utterly impotent in our universe. Compare to the efficiency of e.g. WPA2 keys: less theoretically beautiful, but much more efficient with humans.
        ryanlol 11y ago
        >Without going into the question of how many bits of entropy that actually has when used with human beings in real settings, and just assume it's a perfect check; my question stands: how many people can you find who use this? Probably not very many, but it's really only useful for people that ignore basic security features anyway. (Key auth) >When they do: how many of your hosts do you know the image of? None, I use key auth like any reasonable person would.
        nothrabannosir 11y ago
        Does key auth protect you from a MITM on the first connection? That is, key auth as reasonable people use it, as you said. And this: > but it's really only useful for people that ignore basic security features anyway. (Key auth) is precisely the point: that's a lot of people. SSH doesn't work for those people. We can play the blame game, but at the end of the day, clearly something is "not right". And these are people who use SSH to begin with. Not typically technologically illiterate, I would guess. If they can't even be arsed to use "basic security features", what good is this system, then? Again: there is a way to use SSH properly, yes. But rare is the person who does this. (But key auth is orthogonal to host fingerprinting anyway, this is kind of a red herring)
  - forgottenpass 11y ago
    SSH gets this right No, it doesn't. When was the last time you verified a host key out of band? And if you're using SSH, you know well enough to know why you should do the damn legwork to verify the key. What do you expect for end users? Furthermore, if nobody is doing out of band verification on the first pass, how do you expect users to distinguish between an attack and legit host key change?
    - rwmj 11y ago
      As I said above: Sure, this isn't super-secure for first time visitors to their banking website. But it's fine for the common case where someone tries to MITM you when you move from your home to a coffee shop or vice versa and you're just browsing sites that would otherwise be using http.
    - ryanlol 11y ago
      But the worst case scenario with SSH MitM isn't someone being able to eavesdrop on your connection. But someone pretending to be the server, which is hardly as serious. (Unless you're using password auth, in which case you deserve to get owned)
      - icebraining 11y ago
        If someone impersonates your server, it can then pass the authentication request to the original, and gain full MITM without your knowledge. Yes, even if you use public key auth.
        ryanlol 11y ago
        I will personally pay you the sum of 500 Bitcoins if you can demonstrate a realistic active MitM attack on OpenSSH that allows an active network level attacker to "pass the authentication request to the original" and gain full MitM. Conditions: Public key authentication must be used for authentication. If it's possible to perform the attack passively(e.g on pcaps), it doesn't qualify. This attack has to affect setups using both the latest OpenSSH client and server with default configuration. This attack has to be able to be performed in realtime using the processing power of a 2015 macbook model of your choosing. This attack cannot rely on attacker having any other access but the ability to tamper with the connection however much he wants. This attack cannot rely on known flaws in the encryption algorithms. With full MitM I am referring to the ability to at least access the plaintext communications between the client and server. Eg if the user runs 'sudo', the ability to see the password entered. Please consider this offer legally binding, if you have any questions I will answer them and you can consider the answers binding too. Good luck.
geofft 11y ago
Isn't that what Let's Encrypt is aiming for? Install a package, which configures a cronjob for you? https://letsencrypt.org/howitworks/ https://letsencrypt.org/howitworks/ Which could just even become a default but optional dependency of your distro's web server package, or part of your Docker container, or whatever.
- Nullabillity 11y ago
  I tried to set up LE for my personal bunch of websites, but sadly the rate-limiting is still too strict for automation to be a viable option.
  - geofft 11y ago
    Huh, the rate limits look pretty generous (500 certs every 3 hours): https://community.letsencrypt.org/t/rate-limits-for-lets-encrypt/6769 https://community.letsencrypt.org/t/rate-limits-for-lets-enc... Do you actually own hundreds of personal websites? (And you could still desync them, anyway.) Or is this a use case where wildcards would be useful. I sort of disagree with LE's decision to not care about wildcards for now, though I understand that it's simpler, at least while it's in beta.
    - Nullabillity 11y ago
      That's per IP, you're also limited to 5 requests per domain name per week. In my case, I have a bunch of subdomains for various stuff that all counts against the limit for the main website. I suppose I ought to combine the CSRs, but implementing that makes it a bit more complex than just automatically requesting a certificate per nginx vhost.
      - geofft 11y ago
        Oh, that's pretty rough. Still, with enough automation, you can request 5 per week in a cronjob, which will let you get at least 40-something websites, even with the recommended 60-day renewal cycle. :-P
      - 11y ago
ossreality 11y ago
.... oh boy. I laughed, cringed, shook my head.
mikecb 11y ago
If apache and nginx follow along the lines of Caddy[1], we might. [1] https://caddyserver.com/ https://caddyserver.com/
- StavrosK 11y ago
  I tried Caddy the other day and was pretty impressed. It's a single binary, it automatically installed a Let's Encrypt cert for itself and it had a bunch of other nice features. I'm not going to switch production to it yet, but it's looking like it'll go on my home server pretty soon.
- Nadya 11y ago
  That's... impressive. I'm going to mess around with this over my weekend - thanks for sharing!
x0 11y ago
Seriously this. I don't see why encryption and website verification have been wrapped up in the same thing (SSL certs). They're two different things. Encryption should be free, automatic and default.
- schoen 11y ago
  If you don't have a way to confirm that the key you're seeing from the other site is right, you're inherently vulnerable to a man-in-the-middle attack which removes the benefits of the encryption against the attacker. https://en.wikipedia.org/wiki/Man-in-the-middle_attack https://en.wikipedia.org/wiki/Man-in-the-middle_attack httpS://en.wikipedia.org/wiki/Zooko's_triangle It's not clear that the certificate authority system was or is the best solution to this problem, but it is a problem that calls for some solution. In the case of Domain Validation, we only try to confirm that the key is appropriate to use with the domain name, which is the smallest possible kind of confirmation that can be done to address the crypto problem. There's no attempt to validate or verify anything else about the site.
  - cellularmitosis 11y ago
    However, having one and not the other isn't totally useless. Having the browser be able to track and tell me that "Though we aren't sure this is actually google.com, we do know that the exact same cert has been used the last 50 times you visited this website" is something I'd consider to be useful. (Actually, telling me if it changes would be the useful bit). That would be at least be useful for self-signed certs (though those aren't really needed in light of Let's Encrypt...)
    - cyphar 11y ago
      > However, having one and not the other isn't totally useless. > Having the browser be able to track and tell me that "Though we aren't sure this is actually google.com, we do know that the exact same cert has been used the last 50 times you visited this website" is something I'd consider to be useful. (Actually, telling me if it changes would be the useful bit). Isn't that what you do when you make a security exception for a self-signed certificate? Having that enabled by default lulls people into a false sense of security.

by oliv__ 11y ago

aembleton 11y ago

Because you need to create a public key for the browser to use.

rwmj 11y ago
SSH gets this right -- create a host key when the server is installed, and have the client check the key and only warn/error when it changes. Sure, this isn't super-secure for first time visitors to their banking website or whatever, but those websites can continue to use the current system.
- nothrabannosir 11y ago
  SSH doesn't get this right. It's no better than a (auto-pinned) self-signed cert, in our world. I challenge everyone to find in their extended group of friends and colleagues, and their friends and colleagues, a single person who consistently checks the fingerprint* on every first SSH connection. Id personally have a hard time finding someone who even knows it matters. And if you don't? Mitm can get your password, or tunnel your key to another host, bar some crazy ~/.ssh/config which nobody has. WiFi's WPA2 actually does this better than SSH; the passphrase authenticates both parties to eachother, not just one way. I can't set up a hotspot with your home SSID and intercept your PSK---even on initial connection. SSH: nice in a cryptographic utopia, not better than self signed SSL certs when applied to human beings. SSH is just not suitable for humans. Apparently. * a significant part of it, not just the security-through-obscurity random 2 letters in the middle and the last four.
  - ryanlol 11y ago
    -o VisualHostKey=yes
    - nothrabannosir 11y ago
      A band-aid, I'm afraid. Without going into the question of how many bits of entropy that actually has when used with human beings in real settings, and just assume it's a perfect check; my question stands: how many people can you find who use this? Many SSH clients don't even support it, at all. PuTTY and almost anything that uses SSH for tunneling. When they do: how many of your hosts do you know the image of? Again: nice idea, but utterly impotent in our universe. Compare to the efficiency of e.g. WPA2 keys: less theoretically beautiful, but much more efficient with humans.
      - ryanlol 11y ago
        >Without going into the question of how many bits of entropy that actually has when used with human beings in real settings, and just assume it's a perfect check; my question stands: how many people can you find who use this? Probably not very many, but it's really only useful for people that ignore basic security features anyway. (Key auth) >When they do: how many of your hosts do you know the image of? None, I use key auth like any reasonable person would.
        nothrabannosir 11y ago
        Does key auth protect you from a MITM on the first connection? That is, key auth as reasonable people use it, as you said. And this: > but it's really only useful for people that ignore basic security features anyway. (Key auth) is precisely the point: that's a lot of people. SSH doesn't work for those people. We can play the blame game, but at the end of the day, clearly something is "not right". And these are people who use SSH to begin with. Not typically technologically illiterate, I would guess. If they can't even be arsed to use "basic security features", what good is this system, then? Again: there is a way to use SSH properly, yes. But rare is the person who does this. (But key auth is orthogonal to host fingerprinting anyway, this is kind of a red herring)
- forgottenpass 11y ago
  SSH gets this right No, it doesn't. When was the last time you verified a host key out of band? And if you're using SSH, you know well enough to know why you should do the damn legwork to verify the key. What do you expect for end users? Furthermore, if nobody is doing out of band verification on the first pass, how do you expect users to distinguish between an attack and legit host key change?
  - rwmj 11y ago
    As I said above: Sure, this isn't super-secure for first time visitors to their banking website. But it's fine for the common case where someone tries to MITM you when you move from your home to a coffee shop or vice versa and you're just browsing sites that would otherwise be using http.
  - ryanlol 11y ago
    But the worst case scenario with SSH MitM isn't someone being able to eavesdrop on your connection. But someone pretending to be the server, which is hardly as serious. (Unless you're using password auth, in which case you deserve to get owned)
    - icebraining 11y ago
      If someone impersonates your server, it can then pass the authentication request to the original, and gain full MITM without your knowledge. Yes, even if you use public key auth.
      - ryanlol 11y ago
        I will personally pay you the sum of 500 Bitcoins if you can demonstrate a realistic active MitM attack on OpenSSH that allows an active network level attacker to "pass the authentication request to the original" and gain full MitM. Conditions: Public key authentication must be used for authentication. If it's possible to perform the attack passively(e.g on pcaps), it doesn't qualify. This attack has to affect setups using both the latest OpenSSH client and server with default configuration. This attack has to be able to be performed in realtime using the processing power of a 2015 macbook model of your choosing. This attack cannot rely on attacker having any other access but the ability to tamper with the connection however much he wants. This attack cannot rely on known flaws in the encryption algorithms. With full MitM I am referring to the ability to at least access the plaintext communications between the client and server. Eg if the user runs 'sudo', the ability to see the password entered. Please consider this offer legally binding, if you have any questions I will answer them and you can consider the answers binding too. Good luck.

geofft 11y ago

Isn't that what Let's Encrypt is aiming for? Install a package, which configures a cronjob for you? https://letsencrypt.org/howitworks/ https://letsencrypt.org/howitworks/ Which could just even become a default but optional dependency of your distro's web server package, or part of your Docker container, or whatever.

Nullabillity 11y ago
I tried to set up LE for my personal bunch of websites, but sadly the rate-limiting is still too strict for automation to be a viable option.
- geofft 11y ago
  Huh, the rate limits look pretty generous (500 certs every 3 hours): https://community.letsencrypt.org/t/rate-limits-for-lets-encrypt/6769 https://community.letsencrypt.org/t/rate-limits-for-lets-enc... Do you actually own hundreds of personal websites? (And you could still desync them, anyway.) Or is this a use case where wildcards would be useful. I sort of disagree with LE's decision to not care about wildcards for now, though I understand that it's simpler, at least while it's in beta.
  - Nullabillity 11y ago
    That's per IP, you're also limited to 5 requests per domain name per week. In my case, I have a bunch of subdomains for various stuff that all counts against the limit for the main website. I suppose I ought to combine the CSRs, but implementing that makes it a bit more complex than just automatically requesting a certificate per nginx vhost.
    - geofft 11y ago
      Oh, that's pretty rough. Still, with enough automation, you can request 5 per week in a cronjob, which will let you get at least 40-something websites, even with the recommended 60-day renewal cycle. :-P
    - 11y ago

ossreality 11y ago

.... oh boy. I laughed, cringed, shook my head.

mikecb 11y ago

If apache and nginx follow along the lines of Caddy[1], we might. [1] https://caddyserver.com/ https://caddyserver.com/

StavrosK 11y ago
I tried Caddy the other day and was pretty impressed. It's a single binary, it automatically installed a Let's Encrypt cert for itself and it had a bunch of other nice features. I'm not going to switch production to it yet, but it's looking like it'll go on my home server pretty soon.
Nadya 11y ago
That's... impressive. I'm going to mess around with this over my weekend - thanks for sharing!

x0 11y ago

Seriously this. I don't see why encryption and website verification have been wrapped up in the same thing (SSL certs). They're two different things. Encryption should be free, automatic and default.

schoen 11y ago
If you don't have a way to confirm that the key you're seeing from the other site is right, you're inherently vulnerable to a man-in-the-middle attack which removes the benefits of the encryption against the attacker. https://en.wikipedia.org/wiki/Man-in-the-middle_attack https://en.wikipedia.org/wiki/Man-in-the-middle_attack httpS://en.wikipedia.org/wiki/Zooko's_triangle It's not clear that the certificate authority system was or is the best solution to this problem, but it is a problem that calls for some solution. In the case of Domain Validation, we only try to confirm that the key is appropriate to use with the domain name, which is the smallest possible kind of confirmation that can be done to address the crypto problem. There's no attempt to validate or verify anything else about the site.
- cellularmitosis 11y ago
  However, having one and not the other isn't totally useless. Having the browser be able to track and tell me that "Though we aren't sure this is actually google.com, we do know that the exact same cert has been used the last 50 times you visited this website" is something I'd consider to be useful. (Actually, telling me if it changes would be the useful bit). That would be at least be useful for self-signed certs (though those aren't really needed in light of Let's Encrypt...)
  - cyphar 11y ago
    > However, having one and not the other isn't totally useless. > Having the browser be able to track and tell me that "Though we aren't sure this is actually google.com, we do know that the exact same cert has been used the last 50 times you visited this website" is something I'd consider to be useful. (Actually, telling me if it changes would be the useful bit). Isn't that what you do when you make a security exception for a self-signed certificate? Having that enabled by default lulls people into a false sense of security.