4 ms·
> HTTPS _absolutely_ guarantees non-repudiation and authenticity No it doesn't. Correct HTTPS (i.e. connecting to a site with no errors) guarantees: * the ent
by moviuro 7y ago
> HTTPS _absolutely_ guarantees non-repudiation and authenticity
No it doesn't. Correct HTTPS (i.e. connecting to a site with no errors) guarantees:
* the entity that requested the certificate at the date it did had control over either the website or the DNS for a domain (if it is domain-squatting, it's even legal)
* the Certificate Authority that did deliver that certificate did not suffer a breach; and otherwise followed protocol (CAA - which might be under attack, etc.)
* the client connecting did either: not check for revocation (often), not encounter errors while checking, or silently ignored the absence of reply when asking for the CRL/OCSP responder
And it's precisely because HTTPS doesn't guarantee any kind of authenticity that browsers themselves are dropping visual clues for EV certificates. [0]
[0] https://www.troyhunt.com/extended-validation-certificates-are-really-really-dead/ https://www.troyhunt.com/extended-validation-certificates-ar...
- lvh 7y agoAs I stated in my original comment: sure, if you arbitrarily redefine what terms mean, HTTPS doesn’t provide authenticity or non-repudiation.
- johncolanduoni 7y agoAnd if someone palms your GPG private key, or the public key is not properly authenticated in the first place, you don't get any of the kind of absolute authenticity you're talking about either. You complain about CRL/OCSP, but a GPG keyserver has all the same flaws (with worse default configuration of clients).
- yjftsjthsd-h 7y ago.... you propose that HTTPS is insecure because someone could compromise the website, server, or CA? That precludes... pretty much everything from being "secure". If an attacker can compromise a website and CA, we should assume that they can compromise every other website and every software update server, thereby compromising >90% of computers on Earth inside a week, starting with anything connecting to the Microsoft and Ubuntu update servers.