3 ms·

> perfectly acceptable for a middleware with a valid cert from an authorized CA to intercept the traffic Wow, that is a LOT easier said then done. With today’s

> perfectly acceptable for a middleware with a valid cert from an authorized CA to intercept the traffic Wow, that is a LOT easier said then done. With today’s Certificate Transparency Log requirements, any new certificate must have a cryptographically verifiable entry into at least two different public logs. If a bad actor at a CA were to generate this trusted cert you described, there would have to be a public record of it for it to be trusted. Beyond that, if the CA was found to be complicit, then they would lose their trusted status- looking at you Symantec.

badrabbit 8y ago
If they own the device they can install trusted root CAs that are not public or have CT logs. Anyway,question is if you can call TLS end to end or not.
- move-on-by 8y ago
  Yes, if you own the device, you can choose what to trust beyond valid cert requirements. To answer your question, yes, I do consider TLS end-to-end despite involvement of a 3rd party. I believe certificate transparency has removed a lot of the trust issues around CAs that previously existed. Trust is no longer required when there is public verifiable logs. Also, with the trend moving towards short cert lifespans, the risk of certs being stolen and used against you is more difficult- requiring regular updates. I hope to see the max cert validity periods become shorter and shorter
  - badrabbit 8y ago
    That's ridiculous. The popular CAs are not part of the TLS standard and neither is CT. Plenty of intranet TLS with intetnal CAs. CTs are good if the end client only uses root CAs that participate. Let's say CT solves the server authentication issues,how does does the server authenticate the client? End to end means both parties authenticate,TLS supports client authnetication but a) DNS over HTTPs isn't doing that b) even if it did there isn't CT for client certs...

badrabbit 8y ago

If they own the device they can install trusted root CAs that are not public or have CT logs. Anyway,question is if you can call TLS end to end or not.

move-on-by 8y ago
Yes, if you own the device, you can choose what to trust beyond valid cert requirements. To answer your question, yes, I do consider TLS end-to-end despite involvement of a 3rd party. I believe certificate transparency has removed a lot of the trust issues around CAs that previously existed. Trust is no longer required when there is public verifiable logs. Also, with the trend moving towards short cert lifespans, the risk of certs being stolen and used against you is more difficult- requiring regular updates. I hope to see the max cert validity periods become shorter and shorter
- badrabbit 8y ago
  That's ridiculous. The popular CAs are not part of the TLS standard and neither is CT. Plenty of intranet TLS with intetnal CAs. CTs are good if the end client only uses root CAs that participate. Let's say CT solves the server authentication issues,how does does the server authenticate the client? End to end means both parties authenticate,TLS supports client authnetication but a) DNS over HTTPs isn't doing that b) even if it did there isn't CT for client certs...