5 ms·

I really like when people acknowledge the difference between passive and active attackers. I really, really want there to be more passive protection by default

by thorax 16y ago

I really like when people acknowledge the difference between passive and active attackers. I really, really want there to be more passive protection by default without requiring every computer/node/server to have a trusted certificate. I really would like to see a better handling for this in the case of https as well. I want a way to see a mechanism that a site can offer to provide passive communication protection but where the site does not guarantee its identity, thus meaning it's possible for a MitM attack if you're willing to accept that risk.

avar 16y ago
Just because you don't have signed certificates you can still protect against MitM attacks. Your browser just has to remember what the certificate was the first time, and alert you it if changes. Sound familiar? It should, ssh(1) does this by default.
- tptacek 16y ago
  The first time you connect to any SSH server, the connection can be hijacked. People used to do this for sport at Usenix. Why would anyone accept this weakness with their bank account? My mom barely understands the lock icon.
  - avar 16y ago
    What sort of person goes to a conference like Usenix and connects to an external server for the first time? I've been to a dozen conferences, all of whom I've used ssh at, and I've never connected to an external box for the first time.
    - tptacek 16y ago
      I can't imagine what possible point you could be trying to make. Am I making this up or not? I doubt I am, but who cares? The issue with first-connection security in SSH is a fact, not an opinion.
      - avar 16y ago
        Yes, first-connection security is not an option. But the vast majority of connections are not first connections. If I ssh to a new box at home, then go to Usenix and ssh warns me that the host key changed I'll have protected against MitM attacks, even if the original connection wasn't authenticated.
        tptacek 16y ago
        That model works passably well for SSH connections. You make perhaps tens of those connections every day, from perhaps several devices. It doesn't work at Internet scale. It's too insecure. It's very unlikely that key continuity is going to replace PKI in HTTPS. Do I have strong opinions about PKI vs. key continuity? No. All I'm saying is that it's not a panacea. SSH-style key continuity is not the global solution for the certificate warning Firefox is annoying you with. You realize that Firefox already does this, right? Just hit "add exception" when the dialog pops up. Look! It works just like SSH!
        djcapelis 16y ago
        Arguably, the right way of doing it is to use both. PKI to auth first connect, remember the chain to prevent bad CAs from giving certs people pretending to be BoA.
        pyre 16y ago
        Why not abandon central key authorities and go distributed? Bring social networks and the web-of-trust together. "3 of your friends have said that they trust this certificate from Amazon.com. Do you want to accept it?"
        daeken 16y ago
        If I had a dollar for every time a friend clicked a .exe email attachment, I'd be a very wealthy man. I damn sure don't trust my friends to verify the security of a cert.
- peterwwillis 16y ago
  considering about every third time i visit a high traffic site with ssl i get a new cert pushed to me, i don't think ssh is a good comparison. also, perhaps i skipped over this, but tcpcrypt seems like a level of encryption well below application, thus if we did get a hijacker trying to 'change the self signed cert' after an initial connection (or just dropping the encryption) we wouldn't know, unlike ssl/browsers. am i incorrect?
tptacek 16y ago
I really dislike it when people distinguish between passive and active attackers. Modern attackers are active by default; they proxy connections from phishing sites or attack the DNS. Moreover, even in the '90s, when people actually did stuff like attaching solsniff to the SprintNet backbone, being passive equated to being active, because the passive vantage point gives you TCP sequence numbers, which is all you need to hijack a connection from across the Internet. Your browser already does the thing you're asking for with regards to SSL. Just click through the warnings, which are telling you "encryption without authentication offers very little security, but if you're sure, go ahead and pretend it's doing something for you".
- alister 16y ago
  > Modern attackers are active by default; they proxy connections from phishing sites or attack the DNS. The biggest attackers by far are the NSA and similar agencies -- that's passive attack -- scanning your emails, VOIP calls, browsing habits, etc.

by thorax 16y ago

avar 16y ago

Just because you don't have signed certificates you can still protect against MitM attacks. Your browser just has to remember what the certificate was the first time, and alert you it if changes. Sound familiar? It should, ssh(1) does this by default.

tptacek 16y ago
The first time you connect to any SSH server, the connection can be hijacked. People used to do this for sport at Usenix. Why would anyone accept this weakness with their bank account? My mom barely understands the lock icon.
- avar 16y ago
  What sort of person goes to a conference like Usenix and connects to an external server for the first time? I've been to a dozen conferences, all of whom I've used ssh at, and I've never connected to an external box for the first time.
  - tptacek 16y ago
    I can't imagine what possible point you could be trying to make. Am I making this up or not? I doubt I am, but who cares? The issue with first-connection security in SSH is a fact, not an opinion.
    - avar 16y ago
      Yes, first-connection security is not an option. But the vast majority of connections are not first connections. If I ssh to a new box at home, then go to Usenix and ssh warns me that the host key changed I'll have protected against MitM attacks, even if the original connection wasn't authenticated.
      - tptacek 16y ago
        That model works passably well for SSH connections. You make perhaps tens of those connections every day, from perhaps several devices. It doesn't work at Internet scale. It's too insecure. It's very unlikely that key continuity is going to replace PKI in HTTPS. Do I have strong opinions about PKI vs. key continuity? No. All I'm saying is that it's not a panacea. SSH-style key continuity is not the global solution for the certificate warning Firefox is annoying you with. You realize that Firefox already does this, right? Just hit "add exception" when the dialog pops up. Look! It works just like SSH!
        djcapelis 16y ago
        Arguably, the right way of doing it is to use both. PKI to auth first connect, remember the chain to prevent bad CAs from giving certs people pretending to be BoA.
        pyre 16y ago
        Why not abandon central key authorities and go distributed? Bring social networks and the web-of-trust together. "3 of your friends have said that they trust this certificate from Amazon.com. Do you want to accept it?"
        daeken 16y ago
        If I had a dollar for every time a friend clicked a .exe email attachment, I'd be a very wealthy man. I damn sure don't trust my friends to verify the security of a cert.
peterwwillis 16y ago
considering about every third time i visit a high traffic site with ssl i get a new cert pushed to me, i don't think ssh is a good comparison. also, perhaps i skipped over this, but tcpcrypt seems like a level of encryption well below application, thus if we did get a hijacker trying to 'change the self signed cert' after an initial connection (or just dropping the encryption) we wouldn't know, unlike ssl/browsers. am i incorrect?

tptacek 16y ago

I really dislike it when people distinguish between passive and active attackers. Modern attackers are active by default; they proxy connections from phishing sites or attack the DNS. Moreover, even in the '90s, when people actually did stuff like attaching solsniff to the SprintNet backbone, being passive equated to being active, because the passive vantage point gives you TCP sequence numbers, which is all you need to hijack a connection from across the Internet. Your browser already does the thing you're asking for with regards to SSL. Just click through the warnings, which are telling you "encryption without authentication offers very little security, but if you're sure, go ahead and pretend it's doing something for you".

alister 16y ago
> Modern attackers are active by default; they proxy connections from phishing sites or attack the DNS. The biggest attackers by far are the NSA and similar agencies -- that's passive attack -- scanning your emails, VOIP calls, browsing habits, etc.