8 ms·

And yet somehow browsers have decided that self-signed certificates are less valuable that purchased ones. Seriously?

• wolf550e 10y ago
  If the browser adopts a trust-on-first-use policy with self signed certificates and the certificate is replaced (possibly because it has expired), how do you know whether it's MiTM or benign?
  • robryk 10y ago
    Have a self-signed CA certificate with a longish expiration and sign the actual keys the webservers use with that. Apply TOFU to that CA certificate (on a per-domain basis). There's IIRC no mechanism for that, but for the single-domain CA key it'd make sense to sign the new one with the old one.
    • 45h34jh53k4j 10y ago
      TOFU is bad for the web. Its is much easier to MiTM https vs ssh. Many vendors will sell your enterprise kit to do it to all users. There will be some jurisdictions where MiTM is always and unavoidable. TOFU can't work here. These things must be universal, and TOFU can never be universal.
  • LukeShu 10y ago
    I recall a website with a self-signed cert, but they had a non-https page that had a their TLS cert fingerprint signed with their GPG key; which effectively moved the trust from the centralized CA system to the PGP web of trust. I think it would be cool to have a standard URL (/.well-known/certificate or something) that explains why you should trust their self-signed certificate, and have the browser show that as part of the view when you encounter a self-signed cert.
    • 45h34jh53k4j 10y ago
      Then you have leaked material over http or some other cleartext protocol. If you try to add encryption to that you just have turtles or move the key exchange somewhere else. The current PKI system allows you to make an unsolicited encrypted connections to an internet origin over an untrusted connection with strong server authentication. Self signed can not provide this. We do not want the web to be like SSH.
    • geofft 10y ago
      How many people do you think actually verified the PGP key? https://xkcd.com/1181/ https://xkcd.com/1181/ Also, PGP is a very different security model - in order to effectively use PGP, you need to go disclose your government identity to a handful of other people who are already in the strong set. That's not a great fit for the web.
  • bandrami 10y ago
    Just like you do with ssh: you ask the site administrator. Now, if you have a CA who gives out certificates to parties who should not have them, and that CA can sign certificates for any domain, how do you know if any connection is a MiTM or benign? Do you actually check the issuer every time you connect to a secure site? CAs give a false sense of security. We need to move off this model.
    • icebraining 10y ago
      Just like you do with ssh: you ask the site administrator. How? CAs give a false sense of security. We need to move off this model. Maybe, but not by adopting the politician's syllogism. We should only move to a better model. As easy as it may be, it's still slightly harder to get a CA to sign a cert for a domain you don't control than it is to sign them yourself, and that shouldn't be dismissed.
  • jasonjayr 10y ago
    TOFU + a standard or convention for validating keys with Face-To-Face verfication? If I go to a bank or business, and as part of setting up a relationship they hand me a pamphlet printed with their Public Key Fingerprint, AND the browser shows me that fingerprint image at first use, ..... then that's pretty reliable verification, isn't it?
    • deleted 10y ago
      [deleted]
    • icebraining 10y ago
      Where would you go to check for Amazon's fingerprint?
      • jasonjayr 10y ago
        A standard for face-to-face TOFU checking would be in addition to the PKI infrastructure, and to facilitate a secure way to use self-signed certs. Obviously we've never had face-to-face relationships with the likes of Paypal, Stripe, etc, and would still rely on our browser and operating system vendors to validate the chain of authority.
• mholt 10y ago
  The fact that it's "purchased" has nothing to do with it. The important part is a "trusted" third party (note my use of quotes). Without authentication, the guarantees of confidentiality and integrity are pretty much empty. (In fact, I would argue that free certificates from Let's Encrypt are more trustworthy since the ACME protocol drastically reduces the surface area for attacks on the verification process. See slides[1].) [1]: http://www.thedotpost.com/2016/10/matthew-holt-go-with-acme http://www.thedotpost.com/2016/10/matthew-holt-go-with-acme
• rnhmjoj 10y ago
  And give no warning for plain HTTP pages.
  • zetafunction 10y ago
    Actually, both Chromium [1] and Firefox [2] are working on showing plain HTTP as insecure. [1] https://blog.chromium.org/2016/09/moving-towards-more-secure-web.html https://blog.chromium.org/2016/09/moving-towards-more-secure... [2] https://blog.mozilla.org/tanvi/2016/01/28/no-more-passwords-over-http-please/ https://blog.mozilla.org/tanvi/2016/01/28/no-more-passwords-...
    • bandrami 10y ago
      Great, but if they're treating unvalidated certificates as in any way worse than plaintext (they're strictly better), they are still completely wrong.
      • 45h34jh53k4j 10y ago
        I don't think you can say that self-signed is strictly better than plaintext. Plaintext HTTP gives no illusion that your connection has confidentially, authentication nor integrity. HTTPS is meant to provide all of these things. With a validated, trusted certificate, you get these things. With a self-signed cert, you have none of these things. Knowing that I don't have things is better than thinking i have these things and not. So no, untrusted self-signed can't ever be better. Note cant reply to reply, but all i can say is "With a self-signed cert, I know I am talking to exactly one party and that no third party can surveil or monitor that communication. " (This is not true, as this could easily be my MiTM Proxy that is substituting your self signed public key). Once you introduce 'trusts' you are back to CA land.
        • bandrami 10y ago
          Sigh. This nonsense again. HTTPS is meant to provide all of these things. No. This is absolutely false. HTTPS is a transport protocol (that's the second T) and provides point to point security, only. The fact that we have grafted onto this protocol the notion of authenticity as verified by a warden is an historical accident (and frankly the cause of many problems). With a self-signed cert, you have none of these things. With a self-signed cert, I know I am talking to exactly one party and that no third party can surveil or monitor that communication. This is a channel over which the second party and I can then negotiate authenticity, which is a much better way to do it than the two-headed monster we've built for ourselves. Furthermore, for the vast majority of websites I visit, an assurance from a third party that they are who they say they are is of absolutely no value to me. Take HN: I do not particularly trust ycombinator.com more than I would trust a phisher trying to convince me he is ycombinator.com, so a third party's assurance that this is in fact ycombinator.com doesn't give me any useful information.
• hannob 10y ago
  This comes up so often, and I really wonder what the logic behind this should be. "We have identified a security problem. Therefore instead of fixing it we should abandon all security." Doesn't seem to make a lot of sense to me.
  • josho 10y ago
    No the problem is that we centralized trust instead of designing a distributed trust model. I suspect we centralized trust at the encouragement of folks like the NSA and similar ilk. Regardless, look at the vast majority of technical users relying on SSH without using a CA for secure communications, had browsers done a better job at self-signed certs we could be doing the same on the web.
    • gsnedders 10y ago
      > Regardless, look at the vast majority of technical users relying on SSH without using a CA for secure communications, had browsers done a better job at self-signed certs we could be doing the same on the web. How many technical users actually check the fingerprint matches the expected one of the server, out-of-band? Almost everyone I know just accepts the unknown fingerprint, so almost nobody knows who the endpoint they're actually connected to is.
      • emodendroket 10y ago
        It works OK as long as you're connecting to the correct one the first time, I suppose. But yeah, I agree.
        • deleted 10y ago
          [deleted]
    • jb613 10y ago
      > I suspect we centralized trust at the encouragement of folks like the NSA and similar ilk. In the mid-90's, CA certs were put into Netscape Navigator (IE joined later) in order to facilitate the new wild wacky concept that someone might buy something online. They called it "e-commerce". Trust was centralized because it was far easier to add the then ~half-dozen CA's rather then somehow vetting every joe that wanted to self-sign their certs. PGP's web-of-trust existed but it was deemed less viable. Besides, the whole SSL certs thing was a major business premise behind creating Netscape - profits. Without that there might not have been a dot-com and the huge amount of money that followed since then.
• nsgi 10y ago
  Self signed certificates are always less valuable than purchased ones. The worst case CA breach is equivalent to the normal case of self-signed certificates: a certificate is misissued and an attacker can carry out an active MITM attack. A CA breach cannot enable passive attacks because they don't know the private keys of certificates used by websites.
• emodendroket 10y ago
  How do you prevent man-in-the-middle attacks without the CA?