4 ms·

The difference seems to be that server certificate public keys and CAs will change, so browsers will have to include an "Ignore this change?" prompt, which mean

by caf 8y ago

The difference seems to be that server certificate public keys and CAs will change, so browsers will have to include an "Ignore this change?" prompt, which means a certain number of people will click it. On the other hand, a PAKE failure due to the server not having its half of the authentication data is not possible to ignore, so people will be forced to get it right.

tptacek 8y ago
But certificate authentication precedes user authentication, so the people who don't click it are sufficient to detect misissuance and kill the offending CA. You'd rather not have the problem at all, but if every exploit burns an entire CA, that's not the worst place to be.
- eridius 8y ago
  What happens if the CA change was an intentional change by the server and not the result of an attack?
  - tptacek 8y ago
    In that very rare case, you freak out over nothing.
- tialaramex 8y ago
  I think I generally sympathise with this way of thinking about the value of a PAKE here, and you're right that only one person has to see a smoking gun - but just to be quite clear here on how fragile such manual checks would be: The certificate used for the HTTP transaction where your credentials are submitted may be completely different from the one used to present the web form you filled them into. A sneaky bad guy can let you talk to the real Bob for every single HTTP transaction aside from the one they want to capture, and intercede just for that single case, then drop back out silently, leaving you talking to Bob directly as before. The web browser's own checks (including matching the FQDN against the certificate) run every single time - if they spot Eve taking Bob's place they'll freak out, but any human checks like "Look at the certificate in Certainly Something" (the nice certificate view for Firefox) only happen when a human gets to intervene which may not happen at all at key moments. Imagine you go to https://www.example.com/ https://www.example.com/ to log in It presents a form with a submission target of login.example.com, your browser does a POST to https://login.example.com/login.form/ https://login.example.com/login.form/ and it gets back a 30x redirect to https://www.example.com/welcome/ https://www.example.com/welcome/ When did you get to examine that certificate for login.example.com? The answer in every browser I've seen is not at all, because it responded with a 30x so the page never finished and displayed.

by caf 8y ago

tptacek 8y ago

But certificate authentication precedes user authentication, so the people who don't click it are sufficient to detect misissuance and kill the offending CA. You'd rather not have the problem at all, but if every exploit burns an entire CA, that's not the worst place to be.

eridius 8y ago
What happens if the CA change was an intentional change by the server and not the result of an attack?
- tptacek 8y ago
  In that very rare case, you freak out over nothing.
tialaramex 8y ago
I think I generally sympathise with this way of thinking about the value of a PAKE here, and you're right that only one person has to see a smoking gun - but just to be quite clear here on how fragile such manual checks would be: The certificate used for the HTTP transaction where your credentials are submitted may be completely different from the one used to present the web form you filled them into. A sneaky bad guy can let you talk to the real Bob for every single HTTP transaction aside from the one they want to capture, and intercede just for that single case, then drop back out silently, leaving you talking to Bob directly as before. The web browser's own checks (including matching the FQDN against the certificate) run every single time - if they spot Eve taking Bob's place they'll freak out, but any human checks like "Look at the certificate in Certainly Something" (the nice certificate view for Firefox) only happen when a human gets to intervene which may not happen at all at key moments. Imagine you go to https://www.example.com/ https://www.example.com/ to log in It presents a form with a submission target of login.example.com, your browser does a POST to https://login.example.com/login.form/ https://login.example.com/login.form/ and it gets back a 30x redirect to https://www.example.com/welcome/ https://www.example.com/welcome/ When did you get to examine that certificate for login.example.com? The answer in every browser I've seen is not at all, because it responded with a 30x so the page never finished and displayed.