3 ms·

I trust the Icelandic government more than the least trustworthy of all the CAs trusted by my browser (plus the least trustworthy of all the governments that ha

I trust the Icelandic government more than the least trustworthy of all the CAs trusted by my browser (plus the least trustworthy of all the governments that have power over any of the CAs trusted by my browser). Alternatively I could (in theory) set up my own generic TLD, like Apple has done. Here is their DNSSEC practice statement: https://www.apple.com/legal/intellectual-property/tld/dps/ https://www.apple.com/legal/intellectual-property/tld/dps/ It's still not clear why you think that being able to choose your trust path is strictly worse than being at the mercy of all CAs in the world.

tptacek 10y ago
But if your site is hosted under a .COM, .ORG, .NET, .US, .CO.UK, .ORG.UK, or .IO name, or, for that matter, under a generic TLD managed by any company domiciled in the US, UK, Canada, or Australia, your feeling is: it's just fine that the NSA gets to swap in its own TLS keys for your own whenever it wants. Do you have another TLD besides .IS you might "trust more than the least trustworthy CA in your browser"? Could you name it?
- dane-pgp 10y ago
  If you are relying on the CA system to secure your website, it is equally insecure no matter what TLD your site is under. DNSSEC at least gives you the possibility of moving away from .COM, .ORG, etc to a top-level you trust. You still haven't said what your threat model is, though. The fact you mentioned "protection from governments" earlier suggests that the threat model you are envisaging is "I am trying to run a website that will be attacked by every country in the world". If that's your threat model, I would be interested to know what technology you suggest to counter that threat. Alternatively, if your threat model only includes "US, UK, Canada, or Australia" then there are various other TLDs that are more trustworthy than the Turkish or Chinese governments (no disrespect to those countries). For example, the TLDs of .ch, .dk, .li and .lu. Even .de and .fr should be managed in ways that are independent from the 5 Eyes.
  - tptacek 10y ago
    I can't believe anyone thinks this is the Internet we should be forklifting the DNS out to build. The one where we have to decide which spy agency is going to escrow our TLS keys when we pick a domain name. It's the same day as the announcement of the Snowden pardon appeal drive, and we're saying "fuck it, all of .COM's TLS keys should just go straight to NSA". No. No no no.
    - dane-pgp 10y ago
      Why are you so focused on "all of .COM's TLS keys" when, under the current CA system, all TLS keys for all domains go straight to NSA and any government that controls a CA (e.g. Turkey and China, etc.)? A situation where people can avoid the governments they don't trust is strictly better than this, but you seem to be arguing that it is strictly worse.
      - tptacek 10y ago
        Because: (a) They do not (go ahead and try to get a Google Mail cert). (b) They need not (CA's can be --- and have been --- and will probably within a few weeks be again --- untrusted by browsers) (c) It is insane --- as in, "definition of insanity" insane --- to double down on a hierarchical PKI controlled by governments as a response to problems with the CA system. It is literally the opposite of the direction we should (and are!) going in. I note: in no exchange we have ever had about this issue have you ever so much as rebutted my contention that adopting DNSSEC+DANE would escrow .COM TLS keys with the US government. That's unsurprising, because my contention is true. But I'd like to point it out anyways.
        dane-pgp 10y ago
        (a) The fact that I can't (or won't) get a fake cert for Google Mail doesn't really prove anything. I am not the NSA. I assume you wouldn't accept the challenge if I asked you to produce a fake (but cryptographically valid) DNSSEC response for mail.google.com. (b) Waiting a few months after an attack for a CA to be shut down is not as much comfort as being able to choose in advance which ccTLD or gTLD you are under. As I keep saying, with DNSSEC, the malfeasance of a third party trust source has no effect on your security, unlike the existing case with CAs. (c) Switching from a "chain is as strong as its weakest link" model to one where you can be free from any subset of governments you choose is a strict improvement and very much the right direction to be going in. In response to your note: you have made many claims on this site, and I have rebutted those made in discussions I have been involved in, but I don't remember you making the "escrow" claim in one of the discussions I was involved in. I do remember seeing it recently, though, and laughing to myself about it, trying to work out what was going through your mind when you made that claim. Eventually I realised that by "escrow" you mean "The US government could force Verisign to issue a fake DNSSEC response for a website under .COM", i.e. a situation which is strictly better than "The US government could force Verisign to issue a fake TLS certificate for any website with any domain name." Presumably you would call that key escrow too. I hope I have understood you correctly, and that this counts as a rebuttal, but it's 03:30 here so I'll have to leave this interesting discussion for the night. I look forward to hearing what you have to say in this or another thread soon.
SixSigma 10y ago
Tomorrow's Icelandic govt. could be anybody
- dane-pgp 10y ago
  In fact, next month's Icelandic government could be the Pirate Party, but I would rather trust Iceland not to elect an anti-privacy government than trust all CAs in the world not to be subverted by any anti-privacy government (indeed, some of them already have been).
  - tptacek 10y ago
    Fortunately, trusting all the existing CAs is literally nobody's argument, so we can stop spending time litigating that.
    - dane-pgp 10y ago
      "Trusting all the existing CAs" is literally the status quo, though, right? So whatever it is you are proposing as a replacement needs to be strictly better than that. I've made my case for how DANE is better, but what exactly are you proposing as an alternative? Is it just "trusting all the existing CAs, and distrusting them a few months after they have been caught (using CT) breaking the rules"? You earlier argued that the strength of the CA system is that they "can be --- and have been --- and will probably within a few weeks be again --- untrusted by browsers", but that just sounds like you're saying "the good thing about the CA system is that it keeps failing, and our repeated belated steps to punish malfeasance do not work as a deterrent". Again, I look forward to reading what you propose instead of the CA system and DANE.

tptacek 10y ago

But if your site is hosted under a .COM, .ORG, .NET, .US, .CO.UK, .ORG.UK, or .IO name, or, for that matter, under a generic TLD managed by any company domiciled in the US, UK, Canada, or Australia, your feeling is: it's just fine that the NSA gets to swap in its own TLS keys for your own whenever it wants. Do you have another TLD besides .IS you might "trust more than the least trustworthy CA in your browser"? Could you name it?

dane-pgp 10y ago
If you are relying on the CA system to secure your website, it is equally insecure no matter what TLD your site is under. DNSSEC at least gives you the possibility of moving away from .COM, .ORG, etc to a top-level you trust. You still haven't said what your threat model is, though. The fact you mentioned "protection from governments" earlier suggests that the threat model you are envisaging is "I am trying to run a website that will be attacked by every country in the world". If that's your threat model, I would be interested to know what technology you suggest to counter that threat. Alternatively, if your threat model only includes "US, UK, Canada, or Australia" then there are various other TLDs that are more trustworthy than the Turkish or Chinese governments (no disrespect to those countries). For example, the TLDs of .ch, .dk, .li and .lu. Even .de and .fr should be managed in ways that are independent from the 5 Eyes.
- tptacek 10y ago
  I can't believe anyone thinks this is the Internet we should be forklifting the DNS out to build. The one where we have to decide which spy agency is going to escrow our TLS keys when we pick a domain name. It's the same day as the announcement of the Snowden pardon appeal drive, and we're saying "fuck it, all of .COM's TLS keys should just go straight to NSA". No. No no no.
  - dane-pgp 10y ago
    Why are you so focused on "all of .COM's TLS keys" when, under the current CA system, all TLS keys for all domains go straight to NSA and any government that controls a CA (e.g. Turkey and China, etc.)? A situation where people can avoid the governments they don't trust is strictly better than this, but you seem to be arguing that it is strictly worse.
    - tptacek 10y ago
      Because: (a) They do not (go ahead and try to get a Google Mail cert). (b) They need not (CA's can be --- and have been --- and will probably within a few weeks be again --- untrusted by browsers) (c) It is insane --- as in, "definition of insanity" insane --- to double down on a hierarchical PKI controlled by governments as a response to problems with the CA system. It is literally the opposite of the direction we should (and are!) going in. I note: in no exchange we have ever had about this issue have you ever so much as rebutted my contention that adopting DNSSEC+DANE would escrow .COM TLS keys with the US government. That's unsurprising, because my contention is true. But I'd like to point it out anyways.
      - dane-pgp 10y ago
        (a) The fact that I can't (or won't) get a fake cert for Google Mail doesn't really prove anything. I am not the NSA. I assume you wouldn't accept the challenge if I asked you to produce a fake (but cryptographically valid) DNSSEC response for mail.google.com. (b) Waiting a few months after an attack for a CA to be shut down is not as much comfort as being able to choose in advance which ccTLD or gTLD you are under. As I keep saying, with DNSSEC, the malfeasance of a third party trust source has no effect on your security, unlike the existing case with CAs. (c) Switching from a "chain is as strong as its weakest link" model to one where you can be free from any subset of governments you choose is a strict improvement and very much the right direction to be going in. In response to your note: you have made many claims on this site, and I have rebutted those made in discussions I have been involved in, but I don't remember you making the "escrow" claim in one of the discussions I was involved in. I do remember seeing it recently, though, and laughing to myself about it, trying to work out what was going through your mind when you made that claim. Eventually I realised that by "escrow" you mean "The US government could force Verisign to issue a fake DNSSEC response for a website under .COM", i.e. a situation which is strictly better than "The US government could force Verisign to issue a fake TLS certificate for any website with any domain name." Presumably you would call that key escrow too. I hope I have understood you correctly, and that this counts as a rebuttal, but it's 03:30 here so I'll have to leave this interesting discussion for the night. I look forward to hearing what you have to say in this or another thread soon.

SixSigma 10y ago

Tomorrow's Icelandic govt. could be anybody

dane-pgp 10y ago
In fact, next month's Icelandic government could be the Pirate Party, but I would rather trust Iceland not to elect an anti-privacy government than trust all CAs in the world not to be subverted by any anti-privacy government (indeed, some of them already have been).
- tptacek 10y ago
  Fortunately, trusting all the existing CAs is literally nobody's argument, so we can stop spending time litigating that.
  - dane-pgp 10y ago
    "Trusting all the existing CAs" is literally the status quo, though, right? So whatever it is you are proposing as a replacement needs to be strictly better than that. I've made my case for how DANE is better, but what exactly are you proposing as an alternative? Is it just "trusting all the existing CAs, and distrusting them a few months after they have been caught (using CT) breaking the rules"? You earlier argued that the strength of the CA system is that they "can be --- and have been --- and will probably within a few weeks be again --- untrusted by browsers", but that just sounds like you're saying "the good thing about the CA system is that it keeps failing, and our repeated belated steps to punish malfeasance do not work as a deterrent". Again, I look forward to reading what you propose instead of the CA system and DANE.