4 ms·

It's also possible for a state to suborn a registrar to publish a fraudulent record so that the state can get a DV cert issued by the CA of its choosing. This l

It's also possible for a state to suborn a registrar to publish a fraudulent record so that the state can get a DV cert issued by the CA of its choosing. This leaves the WebPKI in no better shape than DNSSEC + CT when it comes to state level attackers obtaining fraudulent certifications.

tialaramex 7y ago
This is of course why DNSSEC is crucial anyway. DNS is the foundation under the Web PKI, a secure Web PKI on top of insecure DNS doesn't buy you very much. It's impressive we've got this far in fact. It was most fun in the old days, before the Ten Blessed Methods. You'd get this contrast between the wild imaginations of anti-DNSSEC people who imagined every certificate application is investigated by some combination of Jason Bourne and Sherlock Holmes - and a reality where it's just somebody got a blurry fax from a law firm in another country and so they pressed OK because everybody knows lawyers are honest.
- tptacek 7y ago
  I don't know what you're on about with this "Sherlock Holmes" stuff, but the last several CA kill-shots occurred after Google and Mozilla detected misissuances. And Google and Mozilla didn't just revoke the certificates: they killed the CAs themselves. Are you not watching CT logs for domains you work on?
  - tialaramex 7y ago
    As you definitely ought to know if you had any idea about this topic I run a complete Log Monitor for my employer these days and so in that sense I am watching all of the public logs. I also run smaller monitors and auditors for my own interest as an active participant in m.d.s.policy. Which is why it's always weird to hear your version of what goes on there, since you don't participate and seem to base your understanding on something like a tabloid newspaper report or a Hollywood script rather than the reality.
    - tptacek 7y ago
      I don't post on m.d.s.policy or any other standards or community organizations, both because I think all of these sewing-circle groups are a net-negative for security (we'd be better off just letting Ryan Sleevi call the shots), and because not a single one of them them would be better off if I was there mouthing off. I feel like more people --- I can name specific people --- should consider following my lead on this and getting the fuck out of the way on task-oriented forums. There's plenty of other places --- like HN --- to say what I think, and synthesize what I've learned from other people. Don't mistake any of that for me not keeping up with these groups. Your arguments still have to make sense to succeed; you do not in fact have an "I post on m.d.s.policy" card to play here.

tialaramex 7y ago

This is of course why DNSSEC is crucial anyway. DNS is the foundation under the Web PKI, a secure Web PKI on top of insecure DNS doesn't buy you very much. It's impressive we've got this far in fact. It was most fun in the old days, before the Ten Blessed Methods. You'd get this contrast between the wild imaginations of anti-DNSSEC people who imagined every certificate application is investigated by some combination of Jason Bourne and Sherlock Holmes - and a reality where it's just somebody got a blurry fax from a law firm in another country and so they pressed OK because everybody knows lawyers are honest.

tptacek 7y ago
I don't know what you're on about with this "Sherlock Holmes" stuff, but the last several CA kill-shots occurred after Google and Mozilla detected misissuances. And Google and Mozilla didn't just revoke the certificates: they killed the CAs themselves. Are you not watching CT logs for domains you work on?
- tialaramex 7y ago
  As you definitely ought to know if you had any idea about this topic I run a complete Log Monitor for my employer these days and so in that sense I am watching all of the public logs. I also run smaller monitors and auditors for my own interest as an active participant in m.d.s.policy. Which is why it's always weird to hear your version of what goes on there, since you don't participate and seem to base your understanding on something like a tabloid newspaper report or a Hollywood script rather than the reality.
  - tptacek 7y ago
    I don't post on m.d.s.policy or any other standards or community organizations, both because I think all of these sewing-circle groups are a net-negative for security (we'd be better off just letting Ryan Sleevi call the shots), and because not a single one of them them would be better off if I was there mouthing off. I feel like more people --- I can name specific people --- should consider following my lead on this and getting the fuck out of the way on task-oriented forums. There's plenty of other places --- like HN --- to say what I think, and synthesize what I've learned from other people. Don't mistake any of that for me not keeping up with these groups. Your arguments still have to make sense to succeed; you do not in fact have an "I post on m.d.s.policy" card to play here.