3 ms·
The BGP protocol (decentralized without proof or verification), the DNS system (centralized AND decentralized without proof or verification), and SSL (decentral
by rasengan 8y ago
The BGP protocol (decentralized without proof or verification), the DNS system (centralized AND decentralized without proof or verification), and SSL (decentralized without proof or verification) are all relics of the past - design choices that didn’t predict this future.
BGP, SSL, and DNS, create an atmosphere ripe for hijack, MITM and other nefarious activity, and it happens ALL THE TIME.
In other words, the very system “designed to provide trust” actually is also designed to allow rogue actors to utilize that same trust.
It’s insecure AF.
- tialaramex 8y agoCertificates in the Web PKI ("SSL Certificates") are logged to the Certificate Transparency system. Clients can choose to insist upon seeing proof that the certificates they're shown were logged (SCTs), Google's Chrome browser does this today. Name owners can choose to check which certificates were logged for their names, either by operating their own log monitor or by having somebody else do it for them (Facebook will do this for free, but you're welcome to pay somebody if you don't like Facebook, or as I said, you can do it all yourself since the logs are public). In practice even though the existing system is far from perfect we see relatively few problems, and fewer still actual attacks rather than screw-ups.
- throwaway2048 8y agocertificate transparency only does anything for participating CAs, there are dozens/hundreds of CAs that do not participate in certificate transparency, including several either controlled by the Chinese government, or at less than arms length from its influence. They can freely sign anything that isn't either certificate pinned, or has a CAA record. And both those things are client dependent, pretty much any ssl client besides chrome or firefox will not have the capability to do either.