5 ms·

SSL is fundamentally broken. Web-of-trust is the only real way to do security.

by cup-of-tea 9y ago

Spooky23 9y ago
The only thing I trust less than a CA is an army of Russian troll bots.
RKearney 9y ago
Yes, SSL has been broken for some time. That's why TLS was introduced nearly 20 years ago.
- dpark 9y ago
  You presumably got downvoted for being pedantic here, but I think your pedantry is reasonable. If someone's going say "X is fundamentally broken", they should know what X is actually called. Referring to TLS as SSL reeks of amateur hour and shallow knowledge[1], and is a mistake on par with referring to Javascript as Java. [1] This is the sort of lazy mistake I would make, because I'm not a security expert.
  - cup-of-tea 9y ago
    The first line of the blog post calls it SSL. It's irrelevant to what I said because I'm talking about the public key infrastructure.
    - dpark 9y ago
      The blog author is also not a security expert. And I understand that your real criticism was with PKI. That makes it even worse that you called it SSL. Again, I feel like you're showing your lack of expertise in this area. I'm not an expert at all in this area and yet even I can recognize that you're playing armchair security expert.
    - peterwwillis 9y ago
      SSL/TLS are just protocols, they aren't infrastructure. There's a lot of moving parts in the infrastructure that are not these protocols. The protocols work pretty well.
  - zaarn 9y ago
    While not a security expert, I frequently refer to TLS as SSL, mostly when I talk about encrypted connections in general rather than specific protocol versions. It's not quite as bad as calling JS Java or vice versa, it's more like saying Java and then saying Java 1.2 and Java 1.8 and so forth.
    - yjftsjthsd-h 9y ago
      Or better yet, it's like calling it Java 8 and then someone says you don't know what you're talking about because it's technically Java 1.8.
  - jlgaddis 9y ago
    Yes, technically it's TLS, not SSL. TLS, however, is an "evolution" of SSL and many, many people still use this nomenclature. It doesn't "reek of amateur hour and shallow knowledge", it's just a holdover from the past. We all know and understand what others are referring to when they say "SSL". It's like when I tell the girlfriend I'm going to go on a "bike ride". She understands that I mean I'm going for a ride on my Harley, a motorcycle, and not an actual bicycle. Or last weekend, when a friend asked me, "Hey, could you move your car so <other person> can get out?". While I could have stood there arguing with him or correcting him (since my car was actually at home, in my driveway), I instead went out and moved my truck so that the other guest could leave. This excessive, unwarranted pedantry is annoying as hell. You may be "technically correct" but you make everyone around you dislike you.
    - dpark 9y ago
      Your examples are not really comparable, mostly because of context. If someone at a party mentions SSL casually and you feel the need to explain that SSL is dead and they are really talking about TLS, you're just annoying. If someone presents themselves as an expert and says that SSL is "fundamentally broken", it's pretty reasonable to question their expertise. Especially when they actually aren't even talking about TLS but about CAs and PKI. To make an absolute statement about the fundamental soundness of PKI and then use completely the wrong term? Come on. Can you imagine a real expert doing this and not at least recognize their own mistake? Don't talk about "fundamental flaws" when you don't know the difference between SSL and TLS and PKI. This is very much like someone trying to criticize the design of TCP/IP and not knowing the difference between an IP address and a MAC address.
    - Tijdreiziger 9y ago
      > It's like when I tell the girlfriend I'm going to go on a "bike ride". She understands that I mean I'm going for a ride on my Harley, a motorcycle, and not an actual bicycle. Try saying this in the Netherlands (or, presumably, Denmark). Everyone would be surprised when you bring out your motorcycle instead of your bike (i.e., bicycle).
deleted 9y ago
[deleted]
cntlzw 9y ago
SSL is not fundamentally broken. The server authentication process is. Besides what does web-of-trust add? The client usually does not authenticate himself to the server. How should a client share "hey, I trust this server" with others?
- _jal 9y ago
  Real-world SSL is broken above a risk threshold. There are far too many trusted CAs that have repeatedly demonstrated incompetence and all of them are beholden to governments. (There are far too many, period, or in the alternative far too few.) If you have high assurance requirements, SSL with commercial CAs can't be trusted. We have natural experiments showing that WoT, at least as implemented, doesn't scale. I hate that humans don't seem to be able to make it work, but that's reality for you. Yes, I am a security pessimist.
greenhouse_gas 9y ago
It's not. It's actually worse. You're assuming that random people on the internet are going to collectively be more secure than CAs, which is obviously not the case. Imagine you get an email signed by the IRS, and which is trusted by people A1, A2 and A3, who are trusted by people B1, B2, and B3 ... who are trusted by Z1, Z2, and Z3, who are fully trusted by you. Should be reliable, right? But while Z1, Z2 and Z3 may keep all OPSEC rules, you have no guarantee that they verified that Y1, Y2 and Y3 did. And even if they did, you have no guarantee that ... And even if you did, can you guarantee that no one there got any malware, which signed off on a bunch of fake certs?
- cup-of-tea 9y ago
  All you've told me is you don't understand web-of-trust.
  - simonw 9y ago
    Could you help us out by explaining what this comment is misunderstanding?
    - TheCoreh 9y ago
      From my understanding, the example posted is an unlikely degenerate case where the whole "web of trust" between you and another peer consists of three separate parallel paths.
    - cup-of-tea 9y ago
      You wouldn't trust a chain that long with something that sensitive. WOT gives you the ability to have different tiers of trust. If you verified the identity yourself then you can trust it completely. If you accept people verifiying identities on your behalf then you can choose exactly who you trust (ie. not everyone). It not only makes the delegation explicit, it gives you much more fine grained control about how much you can trust a given identity. I'm not saying WOT solves all of our problems. It only makes it slightly better than verifying every key yourself. But it's better than the CA model because you can make it work for you.
nfoz 9y ago
I think the real sentiment here is: good PKI is an unsolved (and perhaps unsolvable) problem.
- cup-of-tea 9y ago
  True. But at least web-of-trust gives you the ability to do something you are comfortable with.
  - dpark 9y ago
    If by "something you are comfortable with" you mean "reject web of trust". Trust is not transitive, which is the problem with web of trust. I trust a set of people. I do not necessarily trust the people those people trust.
    - cup-of-tea 9y ago
      If you reject the web of trust then you're saying you trust nobody (except yourself). Do you really not know anybody you trust to verify identities on your behalf? (That's a trick question because you trust the CAs).
      - dpark 9y ago
        I specifically said that I do trust a set of people. Do you imagine that my small set of trusted people will personally vouch for the authenticity of millions of certs so that I can use the web? Of course not. You imagine instead that I'll trust the next set of people and so on, and that all this transitive trust will let me trust my bank's website. But I don't trust all those random people, which leads to a clear rejection of web of trust.
        cup-of-tea 9y ago
        But you trust the CAs right now. If we used a web of trust system, you could still trust those CAs and nobody else. That's your model that you say isn't broken. You can be happy with that. I'll be happy with trusting people that I trust.

SSL is fundamentally broken. Web-of-trust is the only real way to do security.

Spooky23 9y ago

The only thing I trust less than a CA is an army of Russian troll bots.

RKearney 9y ago

Yes, SSL has been broken for some time. That's why TLS was introduced nearly 20 years ago.

dpark 9y ago
You presumably got downvoted for being pedantic here, but I think your pedantry is reasonable. If someone's going say "X is fundamentally broken", they should know what X is actually called. Referring to TLS as SSL reeks of amateur hour and shallow knowledge[1], and is a mistake on par with referring to Javascript as Java. [1] This is the sort of lazy mistake I would make, because I'm not a security expert.
- cup-of-tea 9y ago
  The first line of the blog post calls it SSL. It's irrelevant to what I said because I'm talking about the public key infrastructure.
  - dpark 9y ago
    The blog author is also not a security expert. And I understand that your real criticism was with PKI. That makes it even worse that you called it SSL. Again, I feel like you're showing your lack of expertise in this area. I'm not an expert at all in this area and yet even I can recognize that you're playing armchair security expert.
  - peterwwillis 9y ago
    SSL/TLS are just protocols, they aren't infrastructure. There's a lot of moving parts in the infrastructure that are not these protocols. The protocols work pretty well.
- zaarn 9y ago
  While not a security expert, I frequently refer to TLS as SSL, mostly when I talk about encrypted connections in general rather than specific protocol versions. It's not quite as bad as calling JS Java or vice versa, it's more like saying Java and then saying Java 1.2 and Java 1.8 and so forth.
  - yjftsjthsd-h 9y ago
    Or better yet, it's like calling it Java 8 and then someone says you don't know what you're talking about because it's technically Java 1.8.
- jlgaddis 9y ago
  Yes, technically it's TLS, not SSL. TLS, however, is an "evolution" of SSL and many, many people still use this nomenclature. It doesn't "reek of amateur hour and shallow knowledge", it's just a holdover from the past. We all know and understand what others are referring to when they say "SSL". It's like when I tell the girlfriend I'm going to go on a "bike ride". She understands that I mean I'm going for a ride on my Harley, a motorcycle, and not an actual bicycle. Or last weekend, when a friend asked me, "Hey, could you move your car so <other person> can get out?". While I could have stood there arguing with him or correcting him (since my car was actually at home, in my driveway), I instead went out and moved my truck so that the other guest could leave. This excessive, unwarranted pedantry is annoying as hell. You may be "technically correct" but you make everyone around you dislike you.
  - dpark 9y ago
    Your examples are not really comparable, mostly because of context. If someone at a party mentions SSL casually and you feel the need to explain that SSL is dead and they are really talking about TLS, you're just annoying. If someone presents themselves as an expert and says that SSL is "fundamentally broken", it's pretty reasonable to question their expertise. Especially when they actually aren't even talking about TLS but about CAs and PKI. To make an absolute statement about the fundamental soundness of PKI and then use completely the wrong term? Come on. Can you imagine a real expert doing this and not at least recognize their own mistake? Don't talk about "fundamental flaws" when you don't know the difference between SSL and TLS and PKI. This is very much like someone trying to criticize the design of TCP/IP and not knowing the difference between an IP address and a MAC address.
  - Tijdreiziger 9y ago
    > It's like when I tell the girlfriend I'm going to go on a "bike ride". She understands that I mean I'm going for a ride on my Harley, a motorcycle, and not an actual bicycle. Try saying this in the Netherlands (or, presumably, Denmark). Everyone would be surprised when you bring out your motorcycle instead of your bike (i.e., bicycle).

deleted 9y ago

[deleted]

cntlzw 9y ago

SSL is not fundamentally broken. The server authentication process is. Besides what does web-of-trust add? The client usually does not authenticate himself to the server. How should a client share "hey, I trust this server" with others?

_jal 9y ago
Real-world SSL is broken above a risk threshold. There are far too many trusted CAs that have repeatedly demonstrated incompetence and all of them are beholden to governments. (There are far too many, period, or in the alternative far too few.) If you have high assurance requirements, SSL with commercial CAs can't be trusted. We have natural experiments showing that WoT, at least as implemented, doesn't scale. I hate that humans don't seem to be able to make it work, but that's reality for you. Yes, I am a security pessimist.

greenhouse_gas 9y ago

It's not. It's actually worse. You're assuming that random people on the internet are going to collectively be more secure than CAs, which is obviously not the case. Imagine you get an email signed by the IRS, and which is trusted by people A1, A2 and A3, who are trusted by people B1, B2, and B3 ... who are trusted by Z1, Z2, and Z3, who are fully trusted by you. Should be reliable, right? But while Z1, Z2 and Z3 may keep all OPSEC rules, you have no guarantee that they verified that Y1, Y2 and Y3 did. And even if they did, you have no guarantee that ... And even if you did, can you guarantee that no one there got any malware, which signed off on a bunch of fake certs?

cup-of-tea 9y ago
All you've told me is you don't understand web-of-trust.
- simonw 9y ago
  Could you help us out by explaining what this comment is misunderstanding?
  - TheCoreh 9y ago
    From my understanding, the example posted is an unlikely degenerate case where the whole "web of trust" between you and another peer consists of three separate parallel paths.
  - cup-of-tea 9y ago
    You wouldn't trust a chain that long with something that sensitive. WOT gives you the ability to have different tiers of trust. If you verified the identity yourself then you can trust it completely. If you accept people verifiying identities on your behalf then you can choose exactly who you trust (ie. not everyone). It not only makes the delegation explicit, it gives you much more fine grained control about how much you can trust a given identity. I'm not saying WOT solves all of our problems. It only makes it slightly better than verifying every key yourself. But it's better than the CA model because you can make it work for you.

nfoz 9y ago

I think the real sentiment here is: good PKI is an unsolved (and perhaps unsolvable) problem.

cup-of-tea 9y ago
True. But at least web-of-trust gives you the ability to do something you are comfortable with.
- dpark 9y ago
  If by "something you are comfortable with" you mean "reject web of trust". Trust is not transitive, which is the problem with web of trust. I trust a set of people. I do not necessarily trust the people those people trust.
  - cup-of-tea 9y ago
    If you reject the web of trust then you're saying you trust nobody (except yourself). Do you really not know anybody you trust to verify identities on your behalf? (That's a trick question because you trust the CAs).
    - dpark 9y ago
      I specifically said that I do trust a set of people. Do you imagine that my small set of trusted people will personally vouch for the authenticity of millions of certs so that I can use the web? Of course not. You imagine instead that I'll trust the next set of people and so on, and that all this transitive trust will let me trust my bank's website. But I don't trust all those random people, which leads to a clear rejection of web of trust.
      - cup-of-tea 9y ago
        But you trust the CAs right now. If we used a web of trust system, you could still trust those CAs and nobody else. That's your model that you say isn't broken. You can be happy with that. I'll be happy with trusting people that I trust.