34 ms·

In the entire article, there is no mention of the (admittedly dangerous [0] and not entirely foolproof [1]) HPKP header. HPKP (HTTP Public Key Pinning) is a he

In the entire article, there is no mention of the (admittedly dangerous [0] and not entirely foolproof [1]) HPKP header. HPKP (HTTP Public Key Pinning) is a header you send to browsers telling them "the only certificates / intermediate certificates you should trust for this domain are: ABC, XYZ. that's it. if a non-matching cert gets presented for this domain, go apeshit.". Using HPKP, you can pin any level of certificate: you can pin your own leaf certificate that you purchase from whomever (or that you get from Lets Encrypt), you can pin that vendor's intermediate cert, you can pin that vendor's root cert, whatever you want. You have to specify at least two pins, and you can mix and match the level of the pins. This is a key point: a lot of (all?) CAs have different intermediate certificates for DV vs EV certificates. If MyCompany Inc buys an EV Cert from ReputableCertVendor (and another from IrreproachableCertVendor) and issues HPKP headers pinning to the EV intermediates of those two vendors, then can't I have a reasonable expectation that those two companies will take measures to make sure they don't issue EV certificates for perceptually-similar domain names (and could I win a court case against them if they did)? Is that level of assurance not what the exorbitant fees are supposed to go towards? [0] a colleague of mine calls it the "HPKP footgun"; if you bought a 1 year cert 10 months ago, start pinning that cert's vendor's intermediate and one other, and _then those two vendors go out of business the next day_, you are going to have a really bad day in a couple months when your existing cert expires (browsers that have visited in the last two months will only honor certs from those two CAs, but you can't get a new one and your old one is expired). [1] HPKP is TOFU (trust on first use, meaning a user/browser has to reach _your site first_ in order to get the "right" HPKP header. If their first visit to mycompany.com is sslstripped or otherwise MITMed, that MITM can and will strip the HPKP header before proxying the response, and then that user/browser doesn't get the benefit of pinning). AFAIK you can't submit your own pins to the browser preload lists like you can with HSTS: https://security.stackexchange.com/questions/143500/are-there-any-mechanisms-to-preload-http-public-key-pinning https://security.stackexchange.com/questions/143500/are-ther...

philsnow 9y ago
Here, I have an idea for how to sell this to the CAs: establish a perceptual distance metric, and the larger a perceptual distance "moat" a customer wants, the more you charge them. then if the customer is google.com, and they've paid for a moat of width 5, and somebody tries to register these domains: domain distance ===================== google.com 0 google.co 1 goegle.com 1 gargle.com 4 gaggle.com 9 example.com 40 then all those with distance <= 5 will get flagged for manual review and the CA will offer google a chance to +1 or -1 it. The person trying to register goegle.com can show trademark paperwork to try to override the -1 decision. OK this is actually not a great idea (too easy to abuse). But what else are all those sweet, sweet EV cert fees going towards?
- tracker1 9y ago
  Actually, allow the registration of up to 5 distance, including xn--* tlds translated... then require anyone registering closer than that to have an EV cert... Have the price set to $20K-$100K/year per order of distance. For a banking establishment, or mega site, it should be reasonable. The option for anyone too close would be to get an EV cert... also requiring EV for any domain within a distance of 4 to alexa top 100, 3 to the alexa top 1000 and 2 to the top 10000 would be a good start.
  - infogulch 9y ago
    This sounds awesome. Should greatly help against the biggest phishing threats, and seems fair for both sides without getting lawyers involved. My question is how would registrars coordinate this?
    - philsnow 9y ago
      > My question is how would registrars coordinate this? A few of them get together and make a pact about how to measure similarity, then convince browser vendors to treat their certificates specially (triple padlocks!! 3 > 1, must be safer!!)?
agwa 9y ago
In theory, yes. In practice, I don't know of any CA which guarantees continuity of intermediate certificates. In fact, some explicitly say they may rotate intermediates at any time. So the footgun is much worse than you describe: even if a CA doesn't go out of business, they may discontinue the intermediate you were pinning. See here for a real-world example of what can go wrong when you pin to intermediates: https://cabforum.org/pipermail/public/2016-November/008989.html https://cabforum.org/pipermail/public/2016-November/008989.h... (in this case, things worked out OK for the customer, but only because Symantec was willing to intentionally break the rules)
pfg 9y ago
> If MyCompany Inc buys an EV Cert from ReputableCertVendor (and another from IrreproachableCertVendor) and issues HPKP headers pinning to the EV intermediates of those two vendors, then can't I have a reasonable expectation that those two companies will take measures to make sure they don't issue EV certificates for perceptually-similar domain names (and could I win a court case against them if they did)? What is your goal here? Pins are per-domain (optionally including all subdomains). They wont affect similar domain names - browsers would accept a certificate from any trusted CA.
- philsnow 9y ago
  shit of course you're right, the article talked explicitly about people not differentiating between the EV browser treatment and the DV browser treatment, so all this iron cladding / gold plating on the domain i'm trying to protect doesn't stop typo squatters doing anything.
vbezhenar 9y ago
HPKP is dangerous. With configuration mistake or lost keys you can render the entire domain unusable. Imagine microsoft.com being lost for 10 years because someone put nonsense in HPKP. It's like nuclear reactor, except the advantage is pretty small and risk is huge.

philsnow 9y ago

Here, I have an idea for how to sell this to the CAs: establish a perceptual distance metric, and the larger a perceptual distance "moat" a customer wants, the more you charge them. then if the customer is google.com, and they've paid for a moat of width 5, and somebody tries to register these domains: domain distance ===================== google.com 0 google.co 1 goegle.com 1 gargle.com 4 gaggle.com 9 example.com 40 then all those with distance <= 5 will get flagged for manual review and the CA will offer google a chance to +1 or -1 it. The person trying to register goegle.com can show trademark paperwork to try to override the -1 decision. OK this is actually not a great idea (too easy to abuse). But what else are all those sweet, sweet EV cert fees going towards?

tracker1 9y ago
Actually, allow the registration of up to 5 distance, including xn--* tlds translated... then require anyone registering closer than that to have an EV cert... Have the price set to $20K-$100K/year per order of distance. For a banking establishment, or mega site, it should be reasonable. The option for anyone too close would be to get an EV cert... also requiring EV for any domain within a distance of 4 to alexa top 100, 3 to the alexa top 1000 and 2 to the top 10000 would be a good start.
- infogulch 9y ago
  This sounds awesome. Should greatly help against the biggest phishing threats, and seems fair for both sides without getting lawyers involved. My question is how would registrars coordinate this?
  - philsnow 9y ago
    > My question is how would registrars coordinate this? A few of them get together and make a pact about how to measure similarity, then convince browser vendors to treat their certificates specially (triple padlocks!! 3 > 1, must be safer!!)?

agwa 9y ago

In theory, yes. In practice, I don't know of any CA which guarantees continuity of intermediate certificates. In fact, some explicitly say they may rotate intermediates at any time. So the footgun is much worse than you describe: even if a CA doesn't go out of business, they may discontinue the intermediate you were pinning. See here for a real-world example of what can go wrong when you pin to intermediates: https://cabforum.org/pipermail/public/2016-November/008989.html https://cabforum.org/pipermail/public/2016-November/008989.h... (in this case, things worked out OK for the customer, but only because Symantec was willing to intentionally break the rules)

pfg 9y ago

> If MyCompany Inc buys an EV Cert from ReputableCertVendor (and another from IrreproachableCertVendor) and issues HPKP headers pinning to the EV intermediates of those two vendors, then can't I have a reasonable expectation that those two companies will take measures to make sure they don't issue EV certificates for perceptually-similar domain names (and could I win a court case against them if they did)? What is your goal here? Pins are per-domain (optionally including all subdomains). They wont affect similar domain names - browsers would accept a certificate from any trusted CA.

philsnow 9y ago
shit of course you're right, the article talked explicitly about people not differentiating between the EV browser treatment and the DV browser treatment, so all this iron cladding / gold plating on the domain i'm trying to protect doesn't stop typo squatters doing anything.

vbezhenar 9y ago

HPKP is dangerous. With configuration mistake or lost keys you can render the entire domain unusable. Imagine microsoft.com being lost for 10 years because someone put nonsense in HPKP. It's like nuclear reactor, except the advantage is pretty small and risk is huge.