5 ms·

How people still think the PKI system is actually delivering security is beyond me. We have zero idea how many bad certs like this may be out there (the nefari

How people still think the PKI system is actually delivering security is beyond me. We have zero idea how many bad certs like this may be out there (the nefarious people won't publish their results, after all), and yet a browser will still treat a Comodo cert as better than a self-signed one (it's identical to a self-signed cert, since Comodo is a known bad actor now). It's better than plaintext, of course, but that's not saying much.

45h34jh53k4j 10y ago
"Dont throw the baby out with the bathwater." We have certificate transparency, the browsers are more responsive and reporting, we have HPKP and other browser countermeasures. Its not perfect but with enough eyeballs it can get close. It provides meaningful security. CA signed clearly not the same as self-signed; Maybe you misunderstand what this means?
- bandrami 10y ago
  CA signed clearly not the same as self-signed How is a certificate from Comodo any different from an self-signed certificate? There is actual evidence that they gave a certificate to a third party. That means you should treat any certificate from them as self-signed, because you cannot trust Comodo to do their jobs.
  - 45h34jh53k4j 10y ago
    Assuming you understand the structural difference between a self signed and a CA signed certificate (ie: subject pubkey sig vs issuer pubkey sig respectively) the difference is clear. You cannot determine provenance of a self-signed certificate. The sig matches the subject. With a CA signed, the hold of the CA private key is the only source (with high probability), so it is attributable. If you trust the company or not -- play with you trust store. Otherwise this is apples and oranges. The only time when this comparison would be apt would be the compromise of the Comodo Private Key. This would allow anyone to issue Comodo certificates, thus removing their provenance. Of course then their cert would be revoked and we wouldn't have this conversation.
    - bandrami 10y ago
      You cannot determine providence of a self-signed certificate. Exactly, though I think you meant "provenance". It's exactly like how we now know we can't determine the provenance of a Comodo certificate, agreed?
      - 45h34jh53k4j 10y ago
        US english term, ill correct it
      - 45h34jh53k4j 10y ago
        No. I think I understand why you are not following what I am saying. You prove that the certificate came from comodo, and only comodo. It can't have come from anyone else. This isnt trust -- its public key crypto. Only the issuer could sign it. If you trust it or not, its irrelevant, only that it could only have possibly originated from there. If you believe that the public key is truly owned by the subject because the issuer said so -- this is trust.
        bandrami 10y ago
        OK, but that's only helpful here in the sense that I could remove Comodo from my trust store, but nobody's going to do that. Not even me, and I'm the one complaining about this. What I can't do is have any confidence in the provenance of a CSR they signed: did it actually come from the organization that controls that domain? (That was what I meant by "provenance")
mholt 10y ago
That's not how this works... > How people still think the PKI system is actually delivering security is beyond me. It has its problems, but it's what we've got to work with right now, and it's not as bad as you make it seem. > it's identical to a self-signed cert, since Comodo is a known bad actor now That's not technically true. I dislike Comodo as much as the next person, but this statement is a bit disingenuous, since you're implying that you can trust anyone who generates their own certificate for google.com or yourbank.com more than a CA-signed certificate. There's a reason PKI exists; it's because self-signed certificates by themselves aren't trustworthy in the wild.
- bandrami 10y ago
  But Comodo can issue a certificate for google.com or yourbank.com They may have, for that matter. Do you check the issuer every time you go to a secure site? Do you trust them to do a better job securing either of those domains than they did with a large telecom in Austria?
  - svenfaw 10y ago
    > Do you check the issuer every time you go to a secure site? Your browser does (for high-value sites). That's what certificate pinning and HPKP are for.
    - bandrami 10y ago
      And they have to do that precisely because there are 170 or so entities of various levels of dubiousness that are by default authorized to sign any certificate for any domain, and everybody knows that this is fundamentally a horrible idea. For that matter, since HPKP requires sideband key management, it's A) an admission that PKI doesn't actually work, and B) a pretty clear example of why the CAs are unnecessary If you have pinned certificates you are essentially operating exactly the way 99% of us do with SSH (only rather better because there are several million eyes on high-value certificates), which means you don't need CAs anymore.
      - 10y ago
umanwizard 10y ago
I still prefer the present situation (States or other resourceful actors might be able to MITM me on some sites) to the scenario without https (any random person whose Wi-Fi you connect to can trivially MITM everything)
- bandrami 10y ago
  I mean, sure, from a practical standpoint I agree we're stuck with PKI, but I think the browsers need to cull, and cull hard, the number of CAs that they trust (and, yes, that would absolutely suck for both CAs and their customers). They also need to be a lot more open to per-user, per-site cert pinning so that we can build trust networks on our own. Most of the sites I connect to I don't actually "trust" in any real sense, so a third party assuring me they are who they say they are isn't useful information for me. (Am I being phished right now? It doesn't matter, because I don't trust news.ycombinator.com with any information I wouldn't also give to a phisher.)
  - umanwizard 10y ago
    Cool, but that is totally different from your position in the comment I was replying to.
    - bandrami 10y ago
      Not really; self-signed certs prevent non-resourceful actors (to use your phrase) pretty well too, well enough that I don't care about the difference for the vast majority of my traffic (how many sites do I actually trust more than I trust some rando pretending to be them? Not many, and those few are the only ones where 3rd-party verification gives me any useful information). If we decoupled the need to just encrypt transport (which is easy) from the need to verify authenticity (which is hard), we wouldn't need so many CAs to begin with (because far fewer sites would need them) and stuff falling through the cracks like this would be both less likely and easier to spot.

45h34jh53k4j 10y ago

"Dont throw the baby out with the bathwater." We have certificate transparency, the browsers are more responsive and reporting, we have HPKP and other browser countermeasures. Its not perfect but with enough eyeballs it can get close. It provides meaningful security. CA signed clearly not the same as self-signed; Maybe you misunderstand what this means?

bandrami 10y ago
CA signed clearly not the same as self-signed How is a certificate from Comodo any different from an self-signed certificate? There is actual evidence that they gave a certificate to a third party. That means you should treat any certificate from them as self-signed, because you cannot trust Comodo to do their jobs.
- 45h34jh53k4j 10y ago
  Assuming you understand the structural difference between a self signed and a CA signed certificate (ie: subject pubkey sig vs issuer pubkey sig respectively) the difference is clear. You cannot determine provenance of a self-signed certificate. The sig matches the subject. With a CA signed, the hold of the CA private key is the only source (with high probability), so it is attributable. If you trust the company or not -- play with you trust store. Otherwise this is apples and oranges. The only time when this comparison would be apt would be the compromise of the Comodo Private Key. This would allow anyone to issue Comodo certificates, thus removing their provenance. Of course then their cert would be revoked and we wouldn't have this conversation.
  - bandrami 10y ago
    You cannot determine providence of a self-signed certificate. Exactly, though I think you meant "provenance". It's exactly like how we now know we can't determine the provenance of a Comodo certificate, agreed?
    - 45h34jh53k4j 10y ago
      US english term, ill correct it
    - 45h34jh53k4j 10y ago
      No. I think I understand why you are not following what I am saying. You prove that the certificate came from comodo, and only comodo. It can't have come from anyone else. This isnt trust -- its public key crypto. Only the issuer could sign it. If you trust it or not, its irrelevant, only that it could only have possibly originated from there. If you believe that the public key is truly owned by the subject because the issuer said so -- this is trust.
      - bandrami 10y ago
        OK, but that's only helpful here in the sense that I could remove Comodo from my trust store, but nobody's going to do that. Not even me, and I'm the one complaining about this. What I can't do is have any confidence in the provenance of a CSR they signed: did it actually come from the organization that controls that domain? (That was what I meant by "provenance")

mholt 10y ago

That's not how this works... > How people still think the PKI system is actually delivering security is beyond me. It has its problems, but it's what we've got to work with right now, and it's not as bad as you make it seem. > it's identical to a self-signed cert, since Comodo is a known bad actor now That's not technically true. I dislike Comodo as much as the next person, but this statement is a bit disingenuous, since you're implying that you can trust anyone who generates their own certificate for google.com or yourbank.com more than a CA-signed certificate. There's a reason PKI exists; it's because self-signed certificates by themselves aren't trustworthy in the wild.

bandrami 10y ago
But Comodo can issue a certificate for google.com or yourbank.com They may have, for that matter. Do you check the issuer every time you go to a secure site? Do you trust them to do a better job securing either of those domains than they did with a large telecom in Austria?
- svenfaw 10y ago
  > Do you check the issuer every time you go to a secure site? Your browser does (for high-value sites). That's what certificate pinning and HPKP are for.
  - bandrami 10y ago
    And they have to do that precisely because there are 170 or so entities of various levels of dubiousness that are by default authorized to sign any certificate for any domain, and everybody knows that this is fundamentally a horrible idea. For that matter, since HPKP requires sideband key management, it's A) an admission that PKI doesn't actually work, and B) a pretty clear example of why the CAs are unnecessary If you have pinned certificates you are essentially operating exactly the way 99% of us do with SSH (only rather better because there are several million eyes on high-value certificates), which means you don't need CAs anymore.
    - 10y ago

umanwizard 10y ago

I still prefer the present situation (States or other resourceful actors might be able to MITM me on some sites) to the scenario without https (any random person whose Wi-Fi you connect to can trivially MITM everything)

bandrami 10y ago
I mean, sure, from a practical standpoint I agree we're stuck with PKI, but I think the browsers need to cull, and cull hard, the number of CAs that they trust (and, yes, that would absolutely suck for both CAs and their customers). They also need to be a lot more open to per-user, per-site cert pinning so that we can build trust networks on our own. Most of the sites I connect to I don't actually "trust" in any real sense, so a third party assuring me they are who they say they are isn't useful information for me. (Am I being phished right now? It doesn't matter, because I don't trust news.ycombinator.com with any information I wouldn't also give to a phisher.)
- umanwizard 10y ago
  Cool, but that is totally different from your position in the comment I was replying to.
  - bandrami 10y ago
    Not really; self-signed certs prevent non-resourceful actors (to use your phrase) pretty well too, well enough that I don't care about the difference for the vast majority of my traffic (how many sites do I actually trust more than I trust some rando pretending to be them? Not many, and those few are the only ones where 3rd-party verification gives me any useful information). If we decoupled the need to just encrypt transport (which is easy) from the need to verify authenticity (which is hard), we wouldn't need so many CAs to begin with (because far fewer sites would need them) and stuff falling through the cracks like this would be both less likely and easier to spot.