5 ms·

Irrelevant - it's way beyond repair. There is virtually nil chance that none of the root CAs are compromised or influenced, or at least influenceable by a crim

by kpil 10y ago

Irrelevant - it's way beyond repair. There is virtually nil chance that none of the root CAs are compromised or influenced, or at least influenceable by a criminal organisation or group. I also doubt that all governmental organisations that have the opportunity to legally influence the CAs have full control of all their employees and that they are not vulnerable to criminals. I also doubt that the governmental organisations of the usual suspected countries involved in government funded industrial espionage are not able to influence CAs - in order to target information in other countries. Actual lawful interception is inevitably possible - but it's a good thing so it can be ignored. Actual political espionage can also be ignored, as it is unlikely to happen to normal people and companies and nearly impossible to avoid without considerate resources. But the first three scenarios are probable, and can cause serious economical harm, and can't be fixed without changing the whole current infrastructure.

eeZi 10y ago
> Irrelevant - it's way beyond repair. Doesn't mean we shouldn't try, since we're not getting rid of if anytime soon. Google's Certificate Transparency is a great approach.
- deleted 10y ago
  [deleted]
- developer2 10y ago
  I think the point the parent was making is that it is likely that one or more of the most prevalent certificate authorities' private keys have been compromised - whether voluntarily provided to government, or obtained by criminals via dubious methods. Once the private keys are compromised, all bets are off. No database - whether maintained by Google or anyone else - puts a dent in such a problem. It's one thing to track inauthentic certificates; it's quite another to discover someone silently decrypting traffic with a copy of the private key. Edit: My response brings up an interesting question I hadn't considered before. With the certificate chain, is it required to have the private keys for the entire chain in order to be able to decrypt the stream? If someone has the certificate authority top-level certificate, can they decrypt a domain's certificate without having its private key as well as any intermediates? If not then it'd be true that the primary concern with a top-level private key being compromised is illegitimate certificates being signed, in which case Google's attempt to combat that with Certificate Transparency isn't half bad.
  - jakewins 10y ago
    Your edit is correct - it is the public certificate that is signed, so a cert authority never sees the private cert and can hence not decrypt downstream. The problem is issuing fake certificates.
  - nikital 10y ago
    As far as I know, you can't trivially decrypt traffic as a passive observer, even if you have the private key of the website or the CA. The sides still perform key exchange using something like Diffie-Hellman. The asymmetric keys are used to verify that you're performing the key exchange with the real server and not with a MITM. If you have the CA's private you must sign your own fake certificate and MITM the connection with the fake certificate. In this case, as you pointed out, Certificate Transparency does help because the fake certificate won't be present in the certificate logs.
pfg 10y ago
Efforts like Certificate Transparency and HPKP solve most of these issues and do not require a full replacement of the Web PKI.
- rocqua 10y ago
  HPKP has the trust on first connect issue, because you can't preload every website. It also has the potential to wreck your site.
euske 10y ago
Again, the root problem, which is universal, is the concentration of power. One company or group or place has so much power for everything in the world, and regulating them has been always the central problem of the human society. But alas, we always need the concentration so badly for the sake of efficiency.
- tremon 10y ago
  But alas, we always need the concentration so badly for the sake of efficiency. Note that this is actually unproven. It is a dogma of modern economics, not an established fact.
droopyEyelids 10y ago
The 'all or nothing' take on security is a very childish or naive point of view. No security system is invulnerable, and even the slightest inconvenience will prevent a certain percent of behavior. In light of those two facts, you must speak about specific threats and attacks if you want to say anything about security. For example: Compromised root CAs have not been found to be used by criminal gangs in bank phishing schemes. Therefore, they seem to provide about the right level of security for that threat. Compromised CAs have been strongly implicated in government attacks, so they don't provide an adequate level of security in that context. This doesn't mean they're beyond repair. They work for certain tasks in certain contexts, like your front door, or a safe, or a password, or a security guard.
- wtbob 10y ago
  > The 'all or nothing' take on security is a very childish or naive point of view. I disagree; indeed, I think the idea that cryptography and security can be flawed-but-useful is itself naïve. If something is breakable, it will be broken; that's why we need to be using the best possible security protocols and standards. > For example: Compromised root CAs have not been found to be used by criminal gangs in bank phishing schemes. They've not been found, which means neither that they've never existed nor that they never will exist.
  - eropple 10y ago
    > If something is breakable, it will be broken Whether it will be broken during the duration of your use by an attacker that you can realistically thwart is the question you must be asking, and that has different answers.
    - mSparks 10y ago
      The ability to issue a malicious certificate gives you the ability to instantly mim any https connection. So about as bad as it gets. Worse, because the user is under the impression there is at least some security on the connection which changes their behavior. - for example most users would now not enter financial details on a non https connection. Does anyone know if there is a log stored in windows 10 of what root authorities were used by different domains?

by kpil 10y ago

eeZi 10y ago

> Irrelevant - it's way beyond repair. Doesn't mean we shouldn't try, since we're not getting rid of if anytime soon. Google's Certificate Transparency is a great approach.

deleted 10y ago
[deleted]
developer2 10y ago
I think the point the parent was making is that it is likely that one or more of the most prevalent certificate authorities' private keys have been compromised - whether voluntarily provided to government, or obtained by criminals via dubious methods. Once the private keys are compromised, all bets are off. No database - whether maintained by Google or anyone else - puts a dent in such a problem. It's one thing to track inauthentic certificates; it's quite another to discover someone silently decrypting traffic with a copy of the private key. Edit: My response brings up an interesting question I hadn't considered before. With the certificate chain, is it required to have the private keys for the entire chain in order to be able to decrypt the stream? If someone has the certificate authority top-level certificate, can they decrypt a domain's certificate without having its private key as well as any intermediates? If not then it'd be true that the primary concern with a top-level private key being compromised is illegitimate certificates being signed, in which case Google's attempt to combat that with Certificate Transparency isn't half bad.
- jakewins 10y ago
  Your edit is correct - it is the public certificate that is signed, so a cert authority never sees the private cert and can hence not decrypt downstream. The problem is issuing fake certificates.
- nikital 10y ago
  As far as I know, you can't trivially decrypt traffic as a passive observer, even if you have the private key of the website or the CA. The sides still perform key exchange using something like Diffie-Hellman. The asymmetric keys are used to verify that you're performing the key exchange with the real server and not with a MITM. If you have the CA's private you must sign your own fake certificate and MITM the connection with the fake certificate. In this case, as you pointed out, Certificate Transparency does help because the fake certificate won't be present in the certificate logs.

pfg 10y ago

Efforts like Certificate Transparency and HPKP solve most of these issues and do not require a full replacement of the Web PKI.

rocqua 10y ago
HPKP has the trust on first connect issue, because you can't preload every website. It also has the potential to wreck your site.

euske 10y ago

Again, the root problem, which is universal, is the concentration of power. One company or group or place has so much power for everything in the world, and regulating them has been always the central problem of the human society. But alas, we always need the concentration so badly for the sake of efficiency.

tremon 10y ago
But alas, we always need the concentration so badly for the sake of efficiency. Note that this is actually unproven. It is a dogma of modern economics, not an established fact.

droopyEyelids 10y ago

The 'all or nothing' take on security is a very childish or naive point of view. No security system is invulnerable, and even the slightest inconvenience will prevent a certain percent of behavior. In light of those two facts, you must speak about specific threats and attacks if you want to say anything about security. For example: Compromised root CAs have not been found to be used by criminal gangs in bank phishing schemes. Therefore, they seem to provide about the right level of security for that threat. Compromised CAs have been strongly implicated in government attacks, so they don't provide an adequate level of security in that context. This doesn't mean they're beyond repair. They work for certain tasks in certain contexts, like your front door, or a safe, or a password, or a security guard.

wtbob 10y ago
> The 'all or nothing' take on security is a very childish or naive point of view. I disagree; indeed, I think the idea that cryptography and security can be flawed-but-useful is itself naïve. If something is breakable, it will be broken; that's why we need to be using the best possible security protocols and standards. > For example: Compromised root CAs have not been found to be used by criminal gangs in bank phishing schemes. They've not been found, which means neither that they've never existed nor that they never will exist.
- eropple 10y ago
  > If something is breakable, it will be broken Whether it will be broken during the duration of your use by an attacker that you can realistically thwart is the question you must be asking, and that has different answers.
  - mSparks 10y ago
    The ability to issue a malicious certificate gives you the ability to instantly mim any https connection. So about as bad as it gets. Worse, because the user is under the impression there is at least some security on the connection which changes their behavior. - for example most users would now not enter financial details on a non https connection. Does anyone know if there is a log stored in windows 10 of what root authorities were used by different domains?