8 ms·

If your threat model contains nation-states, you shouldn't be trusting any CAs in the first place. With a nation-state adversary, you really need to be manuall

If your threat model contains nation-states, you shouldn't be trusting any CAs in the first place. With a nation-state adversary, you really need to be manually verifying certificate hashes that have been securely communicated to you out of band.

bigiain 10y ago
Sure - but from the (to be taken with appropriate credibility rating) WikiPedia page for BlueCoat: "Blue Coat products are primarily used by enterprises, schools, hospitals, governments, and public agencies to block malware and malicious threats, control access to applications and content in the workplace, surveillance, censorship, and improve the performance of network applications." I'm resigned to acknowledging that if the NSA (GHCQ/ASD/insert-local-equivalent at least for five-eyes nations) wants to investigate _me_ specifically, I'm fucked and my only option is to not use the internet (or telephones or mail or or or). I'm not (yet) prepared to give up and hand that level of access to my digital life to enterprises, schools, (most bits of the) government, or public agencies.
- vox_mollis 10y ago
  Ok, so if your adversary is your employer or your school, you are presumably using a network not controlled by you, in which case your endpoint ought to already be a VPN. A good number of employer or school-provider devices will have their own certificates preinstalled anyway. Nobody ever said privacy was convenient.
  - bigiain 10y ago
    I'm good with my work or school owned/issued device trusting a root cert installed by that device's owner. I'm _not good with a school or employer's network being able to generate arbitrary certs for my email, bank, social networks, etc - WITHOUT ME KNOWING ABOUT IT ON MY PERSONAL DEVICES... Sure, MitM me if it's your network - but I 100% should be able to rely on my browser on my device reliably being able to tell me "You're attempting to visit https://mybank.com https://mybank.com, but the certificate identifies it as mybank.suspiciouscorp.net Continue anyway (not recommended): [OK] [Hell no!]"
    - Spooky23 10y ago
      If you have a problem with that, use your own network.
      - TechnicalVault 10y ago
        What if the site they're connecting to has a problem with that? If I for example serve E-Healthcare records, and have an agreement that a given person that I have vetted has access to them, I might have a problem with your unvetted IT staff having access but how would I know?
        Spooky23 10y ago
        Sounds like you have a contract problem with the vetted individual.
      - Dylan16807 10y ago
        Do you see no value in SSL at all, then?
        Spooky23 10y ago
        As a private network owner, I see risk in uncontrolled SSL. If you provide a publicly accessible "Guest" network isolated from my corporate or private resources, that I agree that it's unreasonable to intercept TLS sessions. If you are on my network, which exists to serve my constituents with a personal device, I have every right to or even have a duty to ensure that you aren't threatening the overall integrity of the private network. Whether that be exfiltrating data, bringing in malware, etc. In 2016, the answer to this issue is really simple -- bring your own cellular service.
        Dylan16807 10y ago
        The objection is not to controlling TLS on a private network. The objection is to using a method that can silently intercept connections to devices you don't administrate. If someone doesn't want to install the root cert, then "use your own network" is a perfectly fine response. If someone is upset that the TLS security model is broken in half, then "use your own network" is not a valid response.
tbrownaw 10y ago
I would think that there's a difference between a nation-state targetting me sprcifically, and one running a general dragnet.
- bigiain 10y ago
  Snowden's shown us it's not quite as clear-cut as that, but yeah.
mtgx 10y ago
All sysadmins have nation-states as their threat model (or at least they should have it). If spy agencies can in any way leverage your network, then you're an automatic target. https://theintercept.com/2014/03/20/inside-nsa-secret-efforts-hunt-hack-system-administrators/ https://theintercept.com/2014/03/20/inside-nsa-secret-effort...

bigiain 10y ago

Sure - but from the (to be taken with appropriate credibility rating) WikiPedia page for BlueCoat: "Blue Coat products are primarily used by enterprises, schools, hospitals, governments, and public agencies to block malware and malicious threats, control access to applications and content in the workplace, surveillance, censorship, and improve the performance of network applications." I'm resigned to acknowledging that if the NSA (GHCQ/ASD/insert-local-equivalent at least for five-eyes nations) wants to investigate _me_ specifically, I'm fucked and my only option is to not use the internet (or telephones or mail or or or). I'm not (yet) prepared to give up and hand that level of access to my digital life to enterprises, schools, (most bits of the) government, or public agencies.

vox_mollis 10y ago
Ok, so if your adversary is your employer or your school, you are presumably using a network not controlled by you, in which case your endpoint ought to already be a VPN. A good number of employer or school-provider devices will have their own certificates preinstalled anyway. Nobody ever said privacy was convenient.
- bigiain 10y ago
  I'm good with my work or school owned/issued device trusting a root cert installed by that device's owner. I'm _not good with a school or employer's network being able to generate arbitrary certs for my email, bank, social networks, etc - WITHOUT ME KNOWING ABOUT IT ON MY PERSONAL DEVICES... Sure, MitM me if it's your network - but I 100% should be able to rely on my browser on my device reliably being able to tell me "You're attempting to visit https://mybank.com https://mybank.com, but the certificate identifies it as mybank.suspiciouscorp.net Continue anyway (not recommended): [OK] [Hell no!]"
  - Spooky23 10y ago
    If you have a problem with that, use your own network.
    - TechnicalVault 10y ago
      What if the site they're connecting to has a problem with that? If I for example serve E-Healthcare records, and have an agreement that a given person that I have vetted has access to them, I might have a problem with your unvetted IT staff having access but how would I know?
      - Spooky23 10y ago
        Sounds like you have a contract problem with the vetted individual.
    - Dylan16807 10y ago
      Do you see no value in SSL at all, then?
      - Spooky23 10y ago
        As a private network owner, I see risk in uncontrolled SSL. If you provide a publicly accessible "Guest" network isolated from my corporate or private resources, that I agree that it's unreasonable to intercept TLS sessions. If you are on my network, which exists to serve my constituents with a personal device, I have every right to or even have a duty to ensure that you aren't threatening the overall integrity of the private network. Whether that be exfiltrating data, bringing in malware, etc. In 2016, the answer to this issue is really simple -- bring your own cellular service.
        Dylan16807 10y ago
        The objection is not to controlling TLS on a private network. The objection is to using a method that can silently intercept connections to devices you don't administrate. If someone doesn't want to install the root cert, then "use your own network" is a perfectly fine response. If someone is upset that the TLS security model is broken in half, then "use your own network" is not a valid response.

tbrownaw 10y ago

I would think that there's a difference between a nation-state targetting me sprcifically, and one running a general dragnet.

bigiain 10y ago
Snowden's shown us it's not quite as clear-cut as that, but yeah.

mtgx 10y ago

All sysadmins have nation-states as their threat model (or at least they should have it). If spy agencies can in any way leverage your network, then you're an automatic target. https://theintercept.com/2014/03/20/inside-nsa-secret-efforts-hunt-hack-system-administrators/ https://theintercept.com/2014/03/20/inside-nsa-secret-effort...