6 ms·

If the browser adopts a trust-on-first-use policy with self signed certificates and the certificate is replaced (possibly because it has expired), how do you kn

If the browser adopts a trust-on-first-use policy with self signed certificates and the certificate is replaced (possibly because it has expired), how do you know whether it's MiTM or benign?

robryk 10y ago
Have a self-signed CA certificate with a longish expiration and sign the actual keys the webservers use with that. Apply TOFU to that CA certificate (on a per-domain basis). There's IIRC no mechanism for that, but for the single-domain CA key it'd make sense to sign the new one with the old one.
- 45h34jh53k4j 10y ago
  TOFU is bad for the web. Its is much easier to MiTM https vs ssh. Many vendors will sell your enterprise kit to do it to all users. There will be some jurisdictions where MiTM is always and unavoidable. TOFU can't work here. These things must be universal, and TOFU can never be universal.
LukeShu 10y ago
I recall a website with a self-signed cert, but they had a non-https page that had a their TLS cert fingerprint signed with their GPG key; which effectively moved the trust from the centralized CA system to the PGP web of trust. I think it would be cool to have a standard URL (/.well-known/certificate or something) that explains why you should trust their self-signed certificate, and have the browser show that as part of the view when you encounter a self-signed cert.
- 45h34jh53k4j 10y ago
  Then you have leaked material over http or some other cleartext protocol. If you try to add encryption to that you just have turtles or move the key exchange somewhere else. The current PKI system allows you to make an unsolicited encrypted connections to an internet origin over an untrusted connection with strong server authentication. Self signed can not provide this. We do not want the web to be like SSH.
- geofft 10y ago
  How many people do you think actually verified the PGP key? https://xkcd.com/1181/ https://xkcd.com/1181/ Also, PGP is a very different security model - in order to effectively use PGP, you need to go disclose your government identity to a handful of other people who are already in the strong set. That's not a great fit for the web.
bandrami 10y ago
Just like you do with ssh: you ask the site administrator. Now, if you have a CA who gives out certificates to parties who should not have them, and that CA can sign certificates for any domain, how do you know if any connection is a MiTM or benign? Do you actually check the issuer every time you connect to a secure site? CAs give a false sense of security. We need to move off this model.
- icebraining 10y ago
  Just like you do with ssh: you ask the site administrator. How? CAs give a false sense of security. We need to move off this model. Maybe, but not by adopting the politician's syllogism. We should only move to a better model. As easy as it may be, it's still slightly harder to get a CA to sign a cert for a domain you don't control than it is to sign them yourself, and that shouldn't be dismissed.
jasonjayr 10y ago
TOFU + a standard or convention for validating keys with Face-To-Face verfication? If I go to a bank or business, and as part of setting up a relationship they hand me a pamphlet printed with their Public Key Fingerprint, AND the browser shows me that fingerprint image at first use, ..... then that's pretty reliable verification, isn't it?
- deleted 10y ago
  [deleted]
- icebraining 10y ago
  Where would you go to check for Amazon's fingerprint?
  - jasonjayr 10y ago
    A standard for face-to-face TOFU checking would be in addition to the PKI infrastructure, and to facilitate a secure way to use self-signed certs. Obviously we've never had face-to-face relationships with the likes of Paypal, Stripe, etc, and would still rely on our browser and operating system vendors to validate the chain of authority.

If the browser adopts a trust-on-first-use policy with self signed certificates and the certificate is replaced (possibly because it has expired), how do you know whether it's MiTM or benign?

robryk 10y ago

Have a self-signed CA certificate with a longish expiration and sign the actual keys the webservers use with that. Apply TOFU to that CA certificate (on a per-domain basis). There's IIRC no mechanism for that, but for the single-domain CA key it'd make sense to sign the new one with the old one.

45h34jh53k4j 10y ago
TOFU is bad for the web. Its is much easier to MiTM https vs ssh. Many vendors will sell your enterprise kit to do it to all users. There will be some jurisdictions where MiTM is always and unavoidable. TOFU can't work here. These things must be universal, and TOFU can never be universal.

LukeShu 10y ago

I recall a website with a self-signed cert, but they had a non-https page that had a their TLS cert fingerprint signed with their GPG key; which effectively moved the trust from the centralized CA system to the PGP web of trust. I think it would be cool to have a standard URL (/.well-known/certificate or something) that explains why you should trust their self-signed certificate, and have the browser show that as part of the view when you encounter a self-signed cert.

45h34jh53k4j 10y ago
Then you have leaked material over http or some other cleartext protocol. If you try to add encryption to that you just have turtles or move the key exchange somewhere else. The current PKI system allows you to make an unsolicited encrypted connections to an internet origin over an untrusted connection with strong server authentication. Self signed can not provide this. We do not want the web to be like SSH.
geofft 10y ago
How many people do you think actually verified the PGP key? https://xkcd.com/1181/ https://xkcd.com/1181/ Also, PGP is a very different security model - in order to effectively use PGP, you need to go disclose your government identity to a handful of other people who are already in the strong set. That's not a great fit for the web.

bandrami 10y ago

Just like you do with ssh: you ask the site administrator. Now, if you have a CA who gives out certificates to parties who should not have them, and that CA can sign certificates for any domain, how do you know if any connection is a MiTM or benign? Do you actually check the issuer every time you connect to a secure site? CAs give a false sense of security. We need to move off this model.

icebraining 10y ago
Just like you do with ssh: you ask the site administrator. How? CAs give a false sense of security. We need to move off this model. Maybe, but not by adopting the politician's syllogism. We should only move to a better model. As easy as it may be, it's still slightly harder to get a CA to sign a cert for a domain you don't control than it is to sign them yourself, and that shouldn't be dismissed.

jasonjayr 10y ago

TOFU + a standard or convention for validating keys with Face-To-Face verfication? If I go to a bank or business, and as part of setting up a relationship they hand me a pamphlet printed with their Public Key Fingerprint, AND the browser shows me that fingerprint image at first use, ..... then that's pretty reliable verification, isn't it?

deleted 10y ago
[deleted]
icebraining 10y ago
Where would you go to check for Amazon's fingerprint?
- jasonjayr 10y ago
  A standard for face-to-face TOFU checking would be in addition to the PKI infrastructure, and to facilitate a secure way to use self-signed certs. Obviously we've never had face-to-face relationships with the likes of Paypal, Stripe, etc, and would still rely on our browser and operating system vendors to validate the chain of authority.