3 ms·

Nuke it from orbit. The whole idea of PKI is Broken and Wrong and confuses two different goals. Here's a fun one I noticed: Wells Fargo and several other banks

Nuke it from orbit. The whole idea of PKI is Broken and Wrong and confuses two different goals. Here's a fun one I noticed: Wells Fargo and several other banks are CAs. This is idiotic. The "logic" behind PKI dictates that it's a third party identifying my bank to me. If banks themselves are CAs even that fig leaf doesn't mean much. We have known bad actors in the pool of widely accepted CAs, right now. There's no sense bringing up obscure possibilities of MitMs that might happen absent a CA system: we have bogus certs, in the wild, today. Nuke it from orbit and teach people to pin certificates.

jrochkind1 10y ago
> The "logic" behind PKI dictates that it's a third party identifying my bank to me Not true. The third party is an operational detail to scale, there's no reason your bank is less trusted than anyone else to confirm that they're really your bank, are they? You're suggesting that you don't trust your bank's opinion on what websites belong to them, but do trust some third party's? Even if this made any sense, the third party is doing nothing but taking the bank's word for it, if a bank for some reason _wanted_ to affirm that some random domain was EV-certified as Wells Fargo, they surely could, even if they weren't the CA -- that's just not a threat the CA model is designed against.
- bandrami 10y ago
  there's no reason your bank is less trusted than anyone else to confirm that they're really your bank, are they? Yes, there is. The list of entities I actually care about authenticity for are vanishingly small, basically just financial institutions and CAs themselves (for all other communication I don't trust who I think I'm talking with any more than I would trust a hypothetical man in the middle, so authenticity doesn't give me anything there). But for that small group, I definitely want an entity other than whoever controls their IT infrastructure to be verifying they are who they say they are. Meanwhile, all of the dicking around these attempts at preventing largely-hypothetical active attacks have stalled simply solving the much-easier and arguably more-important issue of simply securing transport against passive attacks. Connecting to TLS to news.ycombinator.com is nice in that I know nobody has read or altered the message in transit. The fact that a third party vouches that news.ycombinator.com is who they say they are doesn't add anything for me, because I don't trust news.ycombinator.com any more than I would trust somebody impersonating news.ycombinator.com. The CA in this situation simply complicates things and adds nothing for me.
  - tptacek 10y ago
    I am having a really hard time following this argument. The CA isn't vouching for the content of your HTTPS requests.
    - bandrami 10y ago
      No, the only thing the CA vouches for is that the other party is who they claim to be, which 99% of the time doesn't matter because I don't trust who they claim to be any more than I trust someone impersonating who they claim to be.
      - tptacek 10y ago
        I'm still lost. What do you think it is that Comodo is vouching for with Hacker News?
        bandrami 10y ago
        That the person who received the certificate from them was in control of the domain (for some definition of "control" that meets Comodo's standards) at the time the certificate was issued. I've never tried to get a wildcard from Comodo, personally, but since there's no O section of the certificate I assume Comodo didn't do anything beyond "do you control the DNS" or "do you control certain email addresses". This is at least less wasteful of time and effort on everybody's part than Comodo verifying that a specific company or person was actually involved; again, I don't trust ycombinator any more than I trust someone impersonating ycombinator, so any 3rd party verification is kind of pointless to me.
      - jrochkind1 10y ago
        How can the CA be _more_ trustworthy as to whether the other party is really Bank of America... than Bank of America itself is? I don't understand your argument, and I think it's a novel interpretation of the CA infrastruture, I think whatever threats you are considering (that Bank of America would intentionally lie about what website is a Bank of America website?) is not something the CA infrastructure was designed to protect against or is capable of protecting against. If authorized Bank of America staff is committed to claiming some website is Bank of America, they can get it trusted as Bank of America by a third-party CA too, can't they? I think by definition any website that authorized Bank of America agents claim is a Bank of America website, _is_ a Bank of America website. That's all it means to be "really" a BoA website, to be a website BoA intentionally meant to represent BoA. I don't think the CA infrastructure can possibly defend against authorized Bank of America agents claiming a website is a BoA website when you think they were wrong to claim that. The CA infrastructure is meant to guarantee that the website was intentionally authorized by Bank of America to be a Bank of America website -- that's it. It doesn't even always do that securely because of flaws, but it never does any more than that. Am I missing something?
geofft 10y ago
OK, so what do you want to happen starting tomorrow morning? * All HTTPS sites show up as trusted. Woohoo! * All HTTPS sites show up as untrusted, people are encouraged to switch to HTTP. Woohoo! * All HTTPS sites use trust-on-first-use, which means that we have a date and time announced when MITM attacks are particularly effective and will persist for a very long time. * All HTTPS sites are untrusted, except for those that already have certificate pins hard-coded in the browsers' source, and excluding those that are pinning their CAs (because CAs are Broken and Wrong), which means the only websites you can access are Google's properties via Google's browser. Awesome! * Replace HTTPS with PGP. Only people who know how to use PGP correctly get to use secure web traffic.
- bandrami 10y ago
  Mostly #5, with some of #4. We have known bad certs in the wild (including for Google) so the "security" PKI offers us is just theater. I think the theater should end, which might actually get people off their asses to fix the real problem and stop outsourcing it to shady rent-seeking companies.
  - tptacek 10y ago
    If the security the CAs offer is "just theater", go spoof DNS and phish Bank of America logins; you should be able to trick users just by rolling self-signed certificates.
    - bandrami 10y ago
      You do know that BofA is one of the organizations with verified bad certificates in the wild, right? This isn't just a theoretical worry. That's why it's "theater": we know that right now there are valid but bad certificates for a depressing number of entities.
      - tptacek 10y ago
        Feel free to win the argument by presenting me with a Bank of America certificate that my browser will validate, which wasn't generated by Bank of America.
aianus 10y ago
> Here's a fun one I noticed: Wells Fargo and several other banks are CA's. This is idiotic. The "logic" behind PKI dictates that it's a third party identifying my bank to me. If banks themselves are CA even that fig leaf doesn't mean much. How is that idiotic? Go to any CA's site and their cert will be (essentially) self-signed. There is no requirement that it's a third party signing the cert, just that it's a 'trusted' party.

jrochkind1 10y ago

> The "logic" behind PKI dictates that it's a third party identifying my bank to me Not true. The third party is an operational detail to scale, there's no reason your bank is less trusted than anyone else to confirm that they're really your bank, are they? You're suggesting that you don't trust your bank's opinion on what websites belong to them, but do trust some third party's? Even if this made any sense, the third party is doing nothing but taking the bank's word for it, if a bank for some reason _wanted_ to affirm that some random domain was EV-certified as Wells Fargo, they surely could, even if they weren't the CA -- that's just not a threat the CA model is designed against.

bandrami 10y ago
there's no reason your bank is less trusted than anyone else to confirm that they're really your bank, are they? Yes, there is. The list of entities I actually care about authenticity for are vanishingly small, basically just financial institutions and CAs themselves (for all other communication I don't trust who I think I'm talking with any more than I would trust a hypothetical man in the middle, so authenticity doesn't give me anything there). But for that small group, I definitely want an entity other than whoever controls their IT infrastructure to be verifying they are who they say they are. Meanwhile, all of the dicking around these attempts at preventing largely-hypothetical active attacks have stalled simply solving the much-easier and arguably more-important issue of simply securing transport against passive attacks. Connecting to TLS to news.ycombinator.com is nice in that I know nobody has read or altered the message in transit. The fact that a third party vouches that news.ycombinator.com is who they say they are doesn't add anything for me, because I don't trust news.ycombinator.com any more than I would trust somebody impersonating news.ycombinator.com. The CA in this situation simply complicates things and adds nothing for me.
- tptacek 10y ago
  I am having a really hard time following this argument. The CA isn't vouching for the content of your HTTPS requests.
  - bandrami 10y ago
    No, the only thing the CA vouches for is that the other party is who they claim to be, which 99% of the time doesn't matter because I don't trust who they claim to be any more than I trust someone impersonating who they claim to be.
    - tptacek 10y ago
      I'm still lost. What do you think it is that Comodo is vouching for with Hacker News?
      - bandrami 10y ago
        That the person who received the certificate from them was in control of the domain (for some definition of "control" that meets Comodo's standards) at the time the certificate was issued. I've never tried to get a wildcard from Comodo, personally, but since there's no O section of the certificate I assume Comodo didn't do anything beyond "do you control the DNS" or "do you control certain email addresses". This is at least less wasteful of time and effort on everybody's part than Comodo verifying that a specific company or person was actually involved; again, I don't trust ycombinator any more than I trust someone impersonating ycombinator, so any 3rd party verification is kind of pointless to me.
    - jrochkind1 10y ago
      How can the CA be _more_ trustworthy as to whether the other party is really Bank of America... than Bank of America itself is? I don't understand your argument, and I think it's a novel interpretation of the CA infrastruture, I think whatever threats you are considering (that Bank of America would intentionally lie about what website is a Bank of America website?) is not something the CA infrastructure was designed to protect against or is capable of protecting against. If authorized Bank of America staff is committed to claiming some website is Bank of America, they can get it trusted as Bank of America by a third-party CA too, can't they? I think by definition any website that authorized Bank of America agents claim is a Bank of America website, _is_ a Bank of America website. That's all it means to be "really" a BoA website, to be a website BoA intentionally meant to represent BoA. I don't think the CA infrastructure can possibly defend against authorized Bank of America agents claiming a website is a BoA website when you think they were wrong to claim that. The CA infrastructure is meant to guarantee that the website was intentionally authorized by Bank of America to be a Bank of America website -- that's it. It doesn't even always do that securely because of flaws, but it never does any more than that. Am I missing something?

geofft 10y ago

OK, so what do you want to happen starting tomorrow morning? * All HTTPS sites show up as trusted. Woohoo! * All HTTPS sites show up as untrusted, people are encouraged to switch to HTTP. Woohoo! * All HTTPS sites use trust-on-first-use, which means that we have a date and time announced when MITM attacks are particularly effective and will persist for a very long time. * All HTTPS sites are untrusted, except for those that already have certificate pins hard-coded in the browsers' source, and excluding those that are pinning their CAs (because CAs are Broken and Wrong), which means the only websites you can access are Google's properties via Google's browser. Awesome! * Replace HTTPS with PGP. Only people who know how to use PGP correctly get to use secure web traffic.

bandrami 10y ago
Mostly #5, with some of #4. We have known bad certs in the wild (including for Google) so the "security" PKI offers us is just theater. I think the theater should end, which might actually get people off their asses to fix the real problem and stop outsourcing it to shady rent-seeking companies.
- tptacek 10y ago
  If the security the CAs offer is "just theater", go spoof DNS and phish Bank of America logins; you should be able to trick users just by rolling self-signed certificates.
  - bandrami 10y ago
    You do know that BofA is one of the organizations with verified bad certificates in the wild, right? This isn't just a theoretical worry. That's why it's "theater": we know that right now there are valid but bad certificates for a depressing number of entities.
    - tptacek 10y ago
      Feel free to win the argument by presenting me with a Bank of America certificate that my browser will validate, which wasn't generated by Bank of America.

aianus 10y ago

> Here's a fun one I noticed: Wells Fargo and several other banks are CA's. This is idiotic. The "logic" behind PKI dictates that it's a third party identifying my bank to me. If banks themselves are CA even that fig leaf doesn't mean much. How is that idiotic? Go to any CA's site and their cert will be (essentially) self-signed. There is no requirement that it's a third party signing the cert, just that it's a 'trusted' party.