6 ms·

This is bullshit. Entrenching TLS in web standards is just handing the keys to the internet over to malicious government entities. We need security without TL

by maxk42 8y ago

This is bullshit. Entrenching TLS in web standards is just handing the keys to the internet over to malicious government entities. We need security without TLS.

ggm 8y ago
Could you expand your thesis a bit?
- est31 8y ago
  I think maxk42 is worried about the TLS certificate root zone which contains many governments. Just look here [1] and search for "government", you'll find various governments mentioned directly. Others are present indirectly, like the german government through the D-TRUST certificates that are operated by the 100% federally-owned company Bundesdruckerei. In the days before things like Certificate Transparency and HSTS preload lists, this was very worrysome because any of these governments could just freely impersonate any website they wanted to decrypt their access to. TLS is very vulnerable to this. SSH still has the TOFU model that is less vulnerable and TLS+TOFU is possible with HPKP but Chrome removed it. I can understand the reasons for the removal but it still had negative consequences. However, Google/Chrome is very avid about Certificate Transparency and many high-value domains are in the HSTS preload list with hardcoded CAs so we are in a better situation than just 5 years ago and I think it is going to improve going forward. So no reason to discard TLS entirely with some kind of nirvana fallacy, but of course, being aware of the problems is always a good thing. [1]: https://ccadb-public.secure.force.com/mozilla/IncludedCACertificateReport https://ccadb-public.secure.force.com/mozilla/IncludedCACert...
  - ggm 8y ago
    Thanks. That was helpful. With letsencrypt it feels like this problem is not the problem it used to be, because most certificates are now self asserted.
    - est31 8y ago
      While Letsencrypt is great, one more CA in the root zone isn't direct improvement of the situation. It's important to realize that any single CA in the root zone can, in theory, without asking anybody or doing anything else, create fake TLS certificates for any website they want and then subsequently use those certificates to perform Man-in-the-Middle attacks. You don't need to specifically trust the CA that signs the certificate of your website: they don't get your private key or anything, only the public key which everyone is getting. Instead, you need to trust every single CA in the root zone. That's at least the idea without certificate transparency (CT). The current SCT policy of Chrome for example increases [1, 2] the numbers of entities needed until a certificate is considered to be valid, and thus, any attack needs the cooperation of multiple such entities as well, making attacks harder to mount. [1]: https://www.entrustdatacard.com/blog/2018/february/chrome-requires-ct-after-april-2018 https://www.entrustdatacard.com/blog/2018/february/chrome-re... [2]: https://fpki.idmanagement.gov/announcements/chromect/ https://fpki.idmanagement.gov/announcements/chromect/
      - ggm 8y ago
        Again thanks. Most clear.
  - tialaramex 8y ago
    Mozilla trusts eight "government" CA roots, associated with 5 countries in this list, China (Hong Kong), Spain, Taiwan, The Netherlands, and Turkey. The Turkish CA is constrained by Mozilla (and so in Firefox, but may not be constrained in your downstream software that wasn't written by Mozilla and just uses their trust lists wholesale) to just Turkish official sites, government, education, that sort of thing. The others are not subject to any notable constraints for a global CA. If you don't run Firefox or a Free Unix you probably trust a lot more government CAs. For example Microsoft's list includes 35 root CAs from Australia to Uruguay. It's hard to do a cursory up-to-the-minute examination of Apple's status because they provide a summary of information from the certificate itself which will often have been written by some nerd twenty years ago, leading to descriptions like "Government Root Certification Authority" and "CA Root" (those are both real examples from Apple's actual list) which don't tell a reader anything of value. I don't regard it as useful morally to try to count a company owned by the government as "the government". Consider the film production company Film 4. This is wholly owned by Channel 4, which is in turn wholly owned by the British government. So we could say the British government made "Four weddings and a funeral". OK, delightful English romantic comedy, sure, maybe drives tourism. "Trainspotting". Maybe it's a warning about how dangerous heroin is? "A Field In England" - Um, now we're struggling, I guess it is set in Britain at least. But wait, "The Motorcycle Diaries" is about the early life of Che Guevara, and "12 Years a Slave" is about a guy who was enslaved, in America. No, Film 4 is just a Film Prodution company, it happens to be owned by the British government, but that's even less relevant than which billionaire owns your favourite hockey team.
- zzzcpan 8y ago
  I think his point is about censorship and mostly about the US, where it's done covertly and there is a lot of influence over organizations that provide tech infrastructure. The government can therefore force those organizations to "voluntarily" participate in censorship programs or deny the service to someone effectively censoring it for almost everyone. Google, Facebook, Twitter already participate in such programs, but of course avoid calling them government censorship.
denormalfloat 8y ago
Ok, what do you want to replace it with? You can't complain about the existing system without offering an alternative. Saying the existing system sucks doesn't help move the Internet towards something better.
- maxk42 8y ago
  You could embed public keys in DNS records for one. But I'll admit I was hoping someone who understands security better than I do would jump in. All I know is that centralized certificate authorities act as choke-points malicious governments can use to censor information.
  - snowwrestler 8y ago
    DNS is even more centralized and tied to governments than CA's are.
    - cryptonector 8y ago
      The WebPKI is easy to compromise because there are so many CAs and NameConstraints cannot be reliably used so the whole thing is not hierarchical. Certificate Transparency (CT) provides the ability to detect some CA abuses, but is not a magic bullet. DNSSEC is absolutely hierarchical and has strong name constraints. Today it has a single root run by ICANN, and run in such a way that hopefully the NSA and friends do not have access to the root key. Nothing stops other countries from legislating national alternative root zones, and nothing stops individuals from maintaining their own alternate root zones. We can expect eventually to see national alternate root zones, and we'll know that then that those states that impose them are almost certainly interested in being able to MITM. The ability to perform recursive lookups locally and use a root of one's choice will make MITMing more difficult. DNSSEC, like WebPKI, is only as strong as the authentication of communications between domain owners/admins and CAs/registrars. With Let's Encrypt the WebPKI is quickly also becoming equally reliant on the security of communications between domain owners/admins and registrars anyways. There are efforts to improve that and reason to believe they'll succeed. So at least as to non-nation-state actors, DANE is already more secure than the WebPKI. QName minimization, and DNS privacy extensions (I wish the IETF would standardize DJB's solution for privacy), will make it very difficult for nation states with access to DNSSEC root zone keys to mount targeted MITM attacks. Non-targeted MITM attacks will be easier to notice than targeted ones. In short, there's no silver bullet. The introduction problem is simply a very difficult one. But DANE looks to have better properties than WebPKI.
JoshTriplett 8y ago
> Entrenching TLS in web standards is just handing the keys to the internet over to malicious government entities. As opposed to cleartext, which hands your content over to everyone. Also, certificate transparency means that it's going to be impossible for someone to MITM a TLS connection by forging a valid CA certificate for the domain without giant warning bells going off everywhere.

by maxk42 8y ago

This is bullshit. Entrenching TLS in web standards is just handing the keys to the internet over to malicious government entities. We need security without TLS.

ggm 8y ago

Could you expand your thesis a bit?

est31 8y ago
I think maxk42 is worried about the TLS certificate root zone which contains many governments. Just look here [1] and search for "government", you'll find various governments mentioned directly. Others are present indirectly, like the german government through the D-TRUST certificates that are operated by the 100% federally-owned company Bundesdruckerei. In the days before things like Certificate Transparency and HSTS preload lists, this was very worrysome because any of these governments could just freely impersonate any website they wanted to decrypt their access to. TLS is very vulnerable to this. SSH still has the TOFU model that is less vulnerable and TLS+TOFU is possible with HPKP but Chrome removed it. I can understand the reasons for the removal but it still had negative consequences. However, Google/Chrome is very avid about Certificate Transparency and many high-value domains are in the HSTS preload list with hardcoded CAs so we are in a better situation than just 5 years ago and I think it is going to improve going forward. So no reason to discard TLS entirely with some kind of nirvana fallacy, but of course, being aware of the problems is always a good thing. [1]: https://ccadb-public.secure.force.com/mozilla/IncludedCACertificateReport https://ccadb-public.secure.force.com/mozilla/IncludedCACert...
- ggm 8y ago
  Thanks. That was helpful. With letsencrypt it feels like this problem is not the problem it used to be, because most certificates are now self asserted.
  - est31 8y ago
    While Letsencrypt is great, one more CA in the root zone isn't direct improvement of the situation. It's important to realize that any single CA in the root zone can, in theory, without asking anybody or doing anything else, create fake TLS certificates for any website they want and then subsequently use those certificates to perform Man-in-the-Middle attacks. You don't need to specifically trust the CA that signs the certificate of your website: they don't get your private key or anything, only the public key which everyone is getting. Instead, you need to trust every single CA in the root zone. That's at least the idea without certificate transparency (CT). The current SCT policy of Chrome for example increases [1, 2] the numbers of entities needed until a certificate is considered to be valid, and thus, any attack needs the cooperation of multiple such entities as well, making attacks harder to mount. [1]: https://www.entrustdatacard.com/blog/2018/february/chrome-requires-ct-after-april-2018 https://www.entrustdatacard.com/blog/2018/february/chrome-re... [2]: https://fpki.idmanagement.gov/announcements/chromect/ https://fpki.idmanagement.gov/announcements/chromect/
    - ggm 8y ago
      Again thanks. Most clear.
- tialaramex 8y ago
  Mozilla trusts eight "government" CA roots, associated with 5 countries in this list, China (Hong Kong), Spain, Taiwan, The Netherlands, and Turkey. The Turkish CA is constrained by Mozilla (and so in Firefox, but may not be constrained in your downstream software that wasn't written by Mozilla and just uses their trust lists wholesale) to just Turkish official sites, government, education, that sort of thing. The others are not subject to any notable constraints for a global CA. If you don't run Firefox or a Free Unix you probably trust a lot more government CAs. For example Microsoft's list includes 35 root CAs from Australia to Uruguay. It's hard to do a cursory up-to-the-minute examination of Apple's status because they provide a summary of information from the certificate itself which will often have been written by some nerd twenty years ago, leading to descriptions like "Government Root Certification Authority" and "CA Root" (those are both real examples from Apple's actual list) which don't tell a reader anything of value. I don't regard it as useful morally to try to count a company owned by the government as "the government". Consider the film production company Film 4. This is wholly owned by Channel 4, which is in turn wholly owned by the British government. So we could say the British government made "Four weddings and a funeral". OK, delightful English romantic comedy, sure, maybe drives tourism. "Trainspotting". Maybe it's a warning about how dangerous heroin is? "A Field In England" - Um, now we're struggling, I guess it is set in Britain at least. But wait, "The Motorcycle Diaries" is about the early life of Che Guevara, and "12 Years a Slave" is about a guy who was enslaved, in America. No, Film 4 is just a Film Prodution company, it happens to be owned by the British government, but that's even less relevant than which billionaire owns your favourite hockey team.
zzzcpan 8y ago
I think his point is about censorship and mostly about the US, where it's done covertly and there is a lot of influence over organizations that provide tech infrastructure. The government can therefore force those organizations to "voluntarily" participate in censorship programs or deny the service to someone effectively censoring it for almost everyone. Google, Facebook, Twitter already participate in such programs, but of course avoid calling them government censorship.

denormalfloat 8y ago

Ok, what do you want to replace it with? You can't complain about the existing system without offering an alternative. Saying the existing system sucks doesn't help move the Internet towards something better.

maxk42 8y ago
You could embed public keys in DNS records for one. But I'll admit I was hoping someone who understands security better than I do would jump in. All I know is that centralized certificate authorities act as choke-points malicious governments can use to censor information.
- snowwrestler 8y ago
  DNS is even more centralized and tied to governments than CA's are.
  - cryptonector 8y ago
    The WebPKI is easy to compromise because there are so many CAs and NameConstraints cannot be reliably used so the whole thing is not hierarchical. Certificate Transparency (CT) provides the ability to detect some CA abuses, but is not a magic bullet. DNSSEC is absolutely hierarchical and has strong name constraints. Today it has a single root run by ICANN, and run in such a way that hopefully the NSA and friends do not have access to the root key. Nothing stops other countries from legislating national alternative root zones, and nothing stops individuals from maintaining their own alternate root zones. We can expect eventually to see national alternate root zones, and we'll know that then that those states that impose them are almost certainly interested in being able to MITM. The ability to perform recursive lookups locally and use a root of one's choice will make MITMing more difficult. DNSSEC, like WebPKI, is only as strong as the authentication of communications between domain owners/admins and CAs/registrars. With Let's Encrypt the WebPKI is quickly also becoming equally reliant on the security of communications between domain owners/admins and registrars anyways. There are efforts to improve that and reason to believe they'll succeed. So at least as to non-nation-state actors, DANE is already more secure than the WebPKI. QName minimization, and DNS privacy extensions (I wish the IETF would standardize DJB's solution for privacy), will make it very difficult for nation states with access to DNSSEC root zone keys to mount targeted MITM attacks. Non-targeted MITM attacks will be easier to notice than targeted ones. In short, there's no silver bullet. The introduction problem is simply a very difficult one. But DANE looks to have better properties than WebPKI.

JoshTriplett 8y ago

> Entrenching TLS in web standards is just handing the keys to the internet over to malicious government entities. As opposed to cleartext, which hands your content over to everyone. Also, certificate transparency means that it's going to be impossible for someone to MITM a TLS connection by forging a valid CA certificate for the domain without giant warning bells going off everywhere.