3 ms·
is there any kind of technical solution that would help flag abuse? for example, something like the way ssh records and flags keys, so that you are warned if t
by andrewcooke 17y ago
is there any kind of technical solution that would help flag abuse?
for example, something like the way ssh records and flags keys, so that you are warned if the certificate you have received, while validated, has changed from what you had received previously?
there would be false positives on expiry, but perhaps they could be flagged as such anyway.
would this help, or am i missing something? obviously it's only going to work if interception is the exception rather than the rule. and it only addresses eavesdropping - it doesn't do anything to stop china implementing some kind of firewall that refuses ssh connections for non-local certs, for example.
- onedognight 17y agoYes, frankly what you are proposing is the only viable solution I can see. The Chinese government can now man-in-the-middle any SSL connection from a browser that has their cert. Be it at a café in the U.S. (by having an agent sitting along side you) or any connection that goes through a router they control. In case you didn't know, this has already been the case for the U.S. government, the Taiwanese government, etc. because SSL root certs (at least the ones in your browser today) know no boundaries. SSH is secure because presumably you know when a certificate should be changing and are suspicious otherwise. Today's browsers don't warn you when a the root cert for a domain changes, but they could.
- wmf 17y agohttp://www.cs.cmu.edu/~perspectives/ http://www.cs.cmu.edu/~perspectives/ should detect and warn about SSL MITMs.
- andrewcooke 17y agocute - same idea but replaces knowledge over time with knowledge over network paths. requires a lot more infrastructure, but removes the "first visit" vulnerability.