47 ms·

One of the big concerns here is that this is another instance of "making the internet less decentralized by leaning on Cloudflare." Someone once pointed out th

by ohazi 7y ago

One of the big concerns here is that this is another instance of "making the internet less decentralized by leaning on Cloudflare." Someone once pointed out that if the NSA wanted to build a front company whose goal was to make hoovering up the internet easier, it would probably look a lot like Cloudflare. I'm generally not much of a conspiracy theorist, but this one has been frustratingly difficult to shrug off.

oskapt 7y ago
It can be less conspiratorial than that. It is a legal and diplomatic challenge for the US to get permission or to install infrastructure to monitor traffic in foreign countries. It is much easier for Cloudflare to drop an ingress server there, and they decrypt all TLS traffic that lands on their systems before possibly re-encrypting it and forwarding it over their private network. Cloudflare is a US company and subject to US coercion. It would be trivial for the US to force Cloudflare to give them access to that data, and with Cloudflare currently decrypting ~10% of all Internet traffic, why wouldn't they? How about the fact that Cloudflare-issued certificates are for dozens of domains? If the US wants to snoop on foreign domain X, a US order for US domain Y, also on the same cert, would give them the private key. It's not possible to detect abuse in this system. It requires that we trust the state to not abuse their power, and we've seen them lie about that already. The mere fact that the Cloudflare system _can_ be abused is, in my opinion, enough reason to go nowhere near it for anything.
- judge2020 7y ago
  Valid concern, just addressing this: > How about the fact that Cloudflare-issued certificates are for dozens of domains? If the US wants to snoop on foreign domain X, a US order for US domain Y, also on the same cert, would give them the private key. Caveat 1 is that they've started to issue 1 cert per domain (I believe only for ECDSA certificates, aka ones that use their own CA), and caveat 2 is that you don't get the actual browser-trusted private key (of course the NSA could demand they turn it over).
  - oskapt 7y ago
    Thanks for clarifying. My research there is a couple years old, but before posting I did some spot checking on CF-hosted domains and did see several using 1:1 certificates. They were all financial institutions, so I figured that there was a way to get Cloudflare to not lump them in with the unwashed masses. I did also still see domains secured by certs for dozens of domains. I'm not sure I understand the 2nd caveat that you list. If Cloudflare issues a cert for a dozen different domains, there's one private key, right? Anyone with that private key could decrypt traffic going to any endpoint secured by that certificate?
    - tialaramex 7y ago
      Nope. Assuming you're using a modern client that's never how it works. Let's take TLS 1.3 where it's designed from the outset for this use case rather than retro-fitted. The effects are similar even in TLS 1.2 (with a modern client) but it's easier to follow in TLS 1.3 1. Client says "Hi, I'm guessing you are willing to use this elliptic curve key agreement method X, I picked a random number and so now I need to tell you a number I got based on that choice which is A" 2. Server says "OK method X works for me, I also picked a random number and I tell you B" 3. At this moment, Server knows an Ephemeral Secret Key for this TLS session, and as soon as it receives message (2) the Client will also know this key, but an eavesdropper won't know this key. Notice that nothing happened with any Private Keys or Certificates or anything yet! 4. Using the now Encrypted Channel with the Ephemeral Secret Key, the Server can present a Certificate, and prove its identity using the corresponding Private Key (optionally the client can do likewise). Now, an _Active_ attacker can use the Private Key to impersonate a server and then proxy everything. But that's quite a step up from passively decrypting traffic. In Channel Binding scenarios the attacker would need to proxy the binding too, which will get out of hand pretty fast, since in TLS both parties have a per-channel secret and that secret won't match between the proxied and real channels.
tedk-42 7y ago
I wonder how long it will take for conspiracy comments like these to pass. Anyone know how long it took for people to trust Lets Encrypt? Or did we all forget (myself included) of the times when people talked about the issue of trusting some random 3rd party handing out free certificates?
- tialaramex 7y ago
  If you mean mechanically, Let's Encrypt uses cross-signed intermediates. What that means is, out of the box your Let's Encrypt cert comes supplied with a "chain" of two certificates, one says "Let's Encrypt says www.example.com has this public key K1, here's proof for Let's Encrypt's public key K2" and then the next says "Let's Encrypt key K2 is trusted on behalf of IdenTrust, here's proof for IdenTrust's key K3". The vast majority of clients in the Web PKI (including all popular web browsers when Let's Encrpyt launched) has baked in trust of IdenTrust via key K3. [ To see an example of what happens if you trust lots of other things from that era but not IdenTrust, try the web browser in a Nintendo WiiU] In parallel the not-for-profit that delivers the Let's Encrypt service, ISRG, sought similar "root trust" in their own key, let's call this K4, and created certificates that says "Let's Encrypt key K2 is trusted on behalf of ISRG, here's proof for IdenTrust's key K4" It took quite some time for the last major trust store to trust ISRG, Microsoft in I think 2018. And there will be lots of smaller or unmaintained trust stores that never catch up to this change. In 2020 ISRG has said they plan to begin weaning people off the cross-signed intermediates, providing a chain with the ISRG signatures instead. In any vaguely modern web browser this will Just Work™ but avoids any problems if at some future date IdenTrust is no longer trusted and avoids ISRG needing continuing help from IdenTrust. If you meant emotionally, I don't know. There are still plenty of people who feel sure that for some reason Let's Encrypt can't be any good because it doesn't cost money.
- ohazi 7y ago
  You don't need to trust Let's Encrypt anywhere near as much as you need to trust Cloudflare. With Let's Encrypt, I generate my own encryption keys and never show the private key to anyone. LE just signs the public key. The risk is that they might also sign someone else's public key as being valid for my domain. But my servers will reject any traffic that isn't encrypted with my real public key. The best an attacker could do is set up a phishing operation. But any CA can improperly sign a public key as being valid for my domain, not just LE. This is just a result of the CA system being broken by design. On the other hand, Cloudflare is usually only useful if you let them terminate TLS on your behalf. So you have to give them your private key, and they really do have access to all of your traffic. At this point, they can do whatever they want with it, largely undetectably (i.e. without the risk of releasing obviously fake certificates into the wild).
zamadatix 7y ago
If it's me browsing the web vs the NSA I'll throw in the towel right now. I'm not expecting DoH, or any protocol, to thwart the largest intelligence agencies in the world. I'm just looking for ISPs and free Wi-Fi hotspots to get a little better for the average user.

by ohazi 7y ago

oskapt 7y ago

It can be less conspiratorial than that. It is a legal and diplomatic challenge for the US to get permission or to install infrastructure to monitor traffic in foreign countries. It is much easier for Cloudflare to drop an ingress server there, and they decrypt all TLS traffic that lands on their systems before possibly re-encrypting it and forwarding it over their private network. Cloudflare is a US company and subject to US coercion. It would be trivial for the US to force Cloudflare to give them access to that data, and with Cloudflare currently decrypting ~10% of all Internet traffic, why wouldn't they? How about the fact that Cloudflare-issued certificates are for dozens of domains? If the US wants to snoop on foreign domain X, a US order for US domain Y, also on the same cert, would give them the private key. It's not possible to detect abuse in this system. It requires that we trust the state to not abuse their power, and we've seen them lie about that already. The mere fact that the Cloudflare system _can_ be abused is, in my opinion, enough reason to go nowhere near it for anything.

judge2020 7y ago
Valid concern, just addressing this: > How about the fact that Cloudflare-issued certificates are for dozens of domains? If the US wants to snoop on foreign domain X, a US order for US domain Y, also on the same cert, would give them the private key. Caveat 1 is that they've started to issue 1 cert per domain (I believe only for ECDSA certificates, aka ones that use their own CA), and caveat 2 is that you don't get the actual browser-trusted private key (of course the NSA could demand they turn it over).
- oskapt 7y ago
  Thanks for clarifying. My research there is a couple years old, but before posting I did some spot checking on CF-hosted domains and did see several using 1:1 certificates. They were all financial institutions, so I figured that there was a way to get Cloudflare to not lump them in with the unwashed masses. I did also still see domains secured by certs for dozens of domains. I'm not sure I understand the 2nd caveat that you list. If Cloudflare issues a cert for a dozen different domains, there's one private key, right? Anyone with that private key could decrypt traffic going to any endpoint secured by that certificate?
  - tialaramex 7y ago
    Nope. Assuming you're using a modern client that's never how it works. Let's take TLS 1.3 where it's designed from the outset for this use case rather than retro-fitted. The effects are similar even in TLS 1.2 (with a modern client) but it's easier to follow in TLS 1.3 1. Client says "Hi, I'm guessing you are willing to use this elliptic curve key agreement method X, I picked a random number and so now I need to tell you a number I got based on that choice which is A" 2. Server says "OK method X works for me, I also picked a random number and I tell you B" 3. At this moment, Server knows an Ephemeral Secret Key for this TLS session, and as soon as it receives message (2) the Client will also know this key, but an eavesdropper won't know this key. Notice that nothing happened with any Private Keys or Certificates or anything yet! 4. Using the now Encrypted Channel with the Ephemeral Secret Key, the Server can present a Certificate, and prove its identity using the corresponding Private Key (optionally the client can do likewise). Now, an _Active_ attacker can use the Private Key to impersonate a server and then proxy everything. But that's quite a step up from passively decrypting traffic. In Channel Binding scenarios the attacker would need to proxy the binding too, which will get out of hand pretty fast, since in TLS both parties have a per-channel secret and that secret won't match between the proxied and real channels.

tedk-42 7y ago

I wonder how long it will take for conspiracy comments like these to pass. Anyone know how long it took for people to trust Lets Encrypt? Or did we all forget (myself included) of the times when people talked about the issue of trusting some random 3rd party handing out free certificates?

tialaramex 7y ago
If you mean mechanically, Let's Encrypt uses cross-signed intermediates. What that means is, out of the box your Let's Encrypt cert comes supplied with a "chain" of two certificates, one says "Let's Encrypt says www.example.com has this public key K1, here's proof for Let's Encrypt's public key K2" and then the next says "Let's Encrypt key K2 is trusted on behalf of IdenTrust, here's proof for IdenTrust's key K3". The vast majority of clients in the Web PKI (including all popular web browsers when Let's Encrpyt launched) has baked in trust of IdenTrust via key K3. [ To see an example of what happens if you trust lots of other things from that era but not IdenTrust, try the web browser in a Nintendo WiiU] In parallel the not-for-profit that delivers the Let's Encrypt service, ISRG, sought similar "root trust" in their own key, let's call this K4, and created certificates that says "Let's Encrypt key K2 is trusted on behalf of ISRG, here's proof for IdenTrust's key K4" It took quite some time for the last major trust store to trust ISRG, Microsoft in I think 2018. And there will be lots of smaller or unmaintained trust stores that never catch up to this change. In 2020 ISRG has said they plan to begin weaning people off the cross-signed intermediates, providing a chain with the ISRG signatures instead. In any vaguely modern web browser this will Just Work™ but avoids any problems if at some future date IdenTrust is no longer trusted and avoids ISRG needing continuing help from IdenTrust. If you meant emotionally, I don't know. There are still plenty of people who feel sure that for some reason Let's Encrypt can't be any good because it doesn't cost money.
ohazi 7y ago
You don't need to trust Let's Encrypt anywhere near as much as you need to trust Cloudflare. With Let's Encrypt, I generate my own encryption keys and never show the private key to anyone. LE just signs the public key. The risk is that they might also sign someone else's public key as being valid for my domain. But my servers will reject any traffic that isn't encrypted with my real public key. The best an attacker could do is set up a phishing operation. But any CA can improperly sign a public key as being valid for my domain, not just LE. This is just a result of the CA system being broken by design. On the other hand, Cloudflare is usually only useful if you let them terminate TLS on your behalf. So you have to give them your private key, and they really do have access to all of your traffic. At this point, they can do whatever they want with it, largely undetectably (i.e. without the risk of releasing obviously fake certificates into the wild).

zamadatix 7y ago

If it's me browsing the web vs the NSA I'll throw in the towel right now. I'm not expecting DoH, or any protocol, to thwart the largest intelligence agencies in the world. I'm just looking for ISPs and free Wi-Fi hotspots to get a little better for the average user.