8 ms·

YES. Please somebody make this. Paint me paranoid, but CA-assisted man in the middle attacks is a real source of concern for me. I would absolutely love to hav

YES. Please somebody make this. Paint me paranoid, but CA-assisted man in the middle attacks is a real source of concern for me. I would absolutely love to have the SSH-style trust model for my HTTPS connections and I will pay good money for an implementation. A simple browser plugin that implements TOFU/POP on top of PKI would be an excellent start.

tptacek 16y ago
How is key continuity any better than PKI against man-in-the-middle attacks? The tradeoff is simple: every first introduction between a browser and a website is insecure, so that subsequent connections might be less insecure. This doesn't look like a win to me. Browsers are introduced to websites all the time. To me, this solution looks like "let's accept an ambient loss of ~5-10% of all connections to MITM attacks, because it's politically too hard to configure the PKI-based SSL protocol properly".
- huhtenberg 16y ago
  > Browsers are introduced to websites all the time. I care most about a handful of sites, most of which are controlled either by me or by people I trust. My co-located mail server would be one of these sites.
  - tptacek 16y ago
    How many times do you set up new computers, or install new browsers, or access a site you care about from a friend's computer? And: you're someone particularly careful about which sites you access. But how is this going to work for my mom? If the problems we're concerned about are government wiretapping and fraud, how does creating a guaranteed and predictable flow of insecure connections not make the problem worse?
    - huhtenberg 16y ago
      Well, it appears that you are responding in the context of the original paper ("let's fix this mess") and I am thinking in the context on my own, very specific immediate need. I do want TOFU/POP now.
      - tptacek 16y ago
        Use Firefox only to access your few trusted sites, and use Chrome or Safari to access the rest of the Internet. Delete all the CA certificates from Firefox. Visit your trusted cites, adding their certs to Firefox as the warnings pop up. There. You now have "tofu/pop".
        huhtenberg 16y ago
        Strange thing there's no emacs in the picture :) Call me eccentric but I don't want to use two browsers, or even two browser profiles. I'd rather make a one time setup change and then go back to my established way of doing things.
- Skalman 16y ago
  Read this sentence again: A simple browser plugin that implements TOFU/POP on top of PKI would be an excellent start. That would - at least to start with - be additional security.
  - tptacek 16y ago
    I don't disagree with that.
- mentat 16y ago
  "every first introduction between a browser and a website is insecure, so that subsequent connections might be less insecure." I think the claim is that this is already the case. There are certificate signing certificates in the hands of people who should not have them and there's no accounting of who has them (beyond the government mentioned) or what they're doing with them. I don't think this presentation is suggesting deleting all your installed CAs, just monitoring whether things are changing under you and coordinating those observations with others you trust. The coordination certainly goes beyond on the SSH model.
  - tptacek 16y ago
    If you believe that, and you don't want to apply software engineering to that problem, then just delete all your CA keys and accept back the ones corresponding to sites you trust. No change to SSL is required to make that process work.
nikcub 16y ago
> SSH-style trust model for my HTTPS connections and I will pay good money for an implementation You can do that now. Note the cert ID first time you login. If it is different the next time you login, then it is a different cert. This would be an easy browser extension.
jmillikin 16y ago
You can have it today! No money or plugins needed. And it only takes a minute to get started. Just delete your CA list. Go into your browser's preferences. Find the "security" section. It should have a button to open up the list of trusted certificate authorities. Delete them all. Now, every time you connect to a secure page, one of two things will happen: 1. If you've never visited that page before, your browser will prompt you for instructions. Use whatever means you like (second browser, remote server, call them, etc) to verify the server's SSL fingerprint. If it checks out, mark it as valid (aka "add an exception"). 2. If you have visited that site before, its exception will already be present in your browser, and it will work like normal. After a few days of this, you'll see why the SSH model hasn't seen widespread adoption for HTTPS.
- huhtenberg 16y ago
  Ha-ha-ha. Not too practical, is it? There are my own servers and there is the rest of the Internet. I want to use self-signed certs on my servers and I want these to be sticky. If any of these servers would suddenly start presenting different certificates (most notably, signed by a CA that sits on browser's trusted list), I want to know about this lovely fact. For the rest of the Internet I can live with existing PKI.
  - caf 16y ago
    That plugin already exists - if you run Firefox, install "Certificate Patrol". It will tell you whenever a site's certificate changes, and it'll show the relevant fields of the old and new certificates side-by-side, so that you can decide whether the change looks benign or malignant.
- Udo 16y ago
  What you describe is exactly the behavior the author calls "Firefox' war on self-signed certificates". The actual proposal calls for a browser that does NOT prompt the user all the time. It would just prompt when something extraordinary happens (such as the server's already known certificate changing). > After a few days of this, you'll see why the SSH model hasn't seen widespread adoption for HTTPS That's not really true. It has simply never been done for browsers, because many people think it's an abomination and, to paraphrase well-known HNers from previous discussions, supposedly useless and little more than obfuscation instead of encryption. It's not the first time TOFU/POP has been suggested on HN, too. I find it curious this proposal got so many upvotes here today. I don't remember that many people coming to mine and other people's defenses when we suggested the exact same thing a few months back and crypto gurus were rending their hair like we had committed the most stupidly blasphemous act conceivable to modern computer science.
mukyu 16y ago
http://www.networknotary.org/firefox.html http://www.networknotary.org/firefox.html https://addons.mozilla.org/en-us/firefox/addon/certificate-patrol/ https://addons.mozilla.org/en-us/firefox/addon/certificate-p...

tptacek 16y ago

How is key continuity any better than PKI against man-in-the-middle attacks? The tradeoff is simple: every first introduction between a browser and a website is insecure, so that subsequent connections might be less insecure. This doesn't look like a win to me. Browsers are introduced to websites all the time. To me, this solution looks like "let's accept an ambient loss of ~5-10% of all connections to MITM attacks, because it's politically too hard to configure the PKI-based SSL protocol properly".

huhtenberg 16y ago
> Browsers are introduced to websites all the time. I care most about a handful of sites, most of which are controlled either by me or by people I trust. My co-located mail server would be one of these sites.
- tptacek 16y ago
  How many times do you set up new computers, or install new browsers, or access a site you care about from a friend's computer? And: you're someone particularly careful about which sites you access. But how is this going to work for my mom? If the problems we're concerned about are government wiretapping and fraud, how does creating a guaranteed and predictable flow of insecure connections not make the problem worse?
  - huhtenberg 16y ago
    Well, it appears that you are responding in the context of the original paper ("let's fix this mess") and I am thinking in the context on my own, very specific immediate need. I do want TOFU/POP now.
    - tptacek 16y ago
      Use Firefox only to access your few trusted sites, and use Chrome or Safari to access the rest of the Internet. Delete all the CA certificates from Firefox. Visit your trusted cites, adding their certs to Firefox as the warnings pop up. There. You now have "tofu/pop".
      - huhtenberg 16y ago
        Strange thing there's no emacs in the picture :) Call me eccentric but I don't want to use two browsers, or even two browser profiles. I'd rather make a one time setup change and then go back to my established way of doing things.
Skalman 16y ago
Read this sentence again: A simple browser plugin that implements TOFU/POP on top of PKI would be an excellent start. That would - at least to start with - be additional security.
- tptacek 16y ago
  I don't disagree with that.
mentat 16y ago
"every first introduction between a browser and a website is insecure, so that subsequent connections might be less insecure." I think the claim is that this is already the case. There are certificate signing certificates in the hands of people who should not have them and there's no accounting of who has them (beyond the government mentioned) or what they're doing with them. I don't think this presentation is suggesting deleting all your installed CAs, just monitoring whether things are changing under you and coordinating those observations with others you trust. The coordination certainly goes beyond on the SSH model.
- tptacek 16y ago
  If you believe that, and you don't want to apply software engineering to that problem, then just delete all your CA keys and accept back the ones corresponding to sites you trust. No change to SSL is required to make that process work.

nikcub 16y ago

> SSH-style trust model for my HTTPS connections and I will pay good money for an implementation You can do that now. Note the cert ID first time you login. If it is different the next time you login, then it is a different cert. This would be an easy browser extension.

jmillikin 16y ago

You can have it today! No money or plugins needed. And it only takes a minute to get started. Just delete your CA list. Go into your browser's preferences. Find the "security" section. It should have a button to open up the list of trusted certificate authorities. Delete them all. Now, every time you connect to a secure page, one of two things will happen: 1. If you've never visited that page before, your browser will prompt you for instructions. Use whatever means you like (second browser, remote server, call them, etc) to verify the server's SSL fingerprint. If it checks out, mark it as valid (aka "add an exception"). 2. If you have visited that site before, its exception will already be present in your browser, and it will work like normal. After a few days of this, you'll see why the SSH model hasn't seen widespread adoption for HTTPS.

huhtenberg 16y ago
Ha-ha-ha. Not too practical, is it? There are my own servers and there is the rest of the Internet. I want to use self-signed certs on my servers and I want these to be sticky. If any of these servers would suddenly start presenting different certificates (most notably, signed by a CA that sits on browser's trusted list), I want to know about this lovely fact. For the rest of the Internet I can live with existing PKI.
- caf 16y ago
  That plugin already exists - if you run Firefox, install "Certificate Patrol". It will tell you whenever a site's certificate changes, and it'll show the relevant fields of the old and new certificates side-by-side, so that you can decide whether the change looks benign or malignant.
Udo 16y ago
What you describe is exactly the behavior the author calls "Firefox' war on self-signed certificates". The actual proposal calls for a browser that does NOT prompt the user all the time. It would just prompt when something extraordinary happens (such as the server's already known certificate changing). > After a few days of this, you'll see why the SSH model hasn't seen widespread adoption for HTTPS That's not really true. It has simply never been done for browsers, because many people think it's an abomination and, to paraphrase well-known HNers from previous discussions, supposedly useless and little more than obfuscation instead of encryption. It's not the first time TOFU/POP has been suggested on HN, too. I find it curious this proposal got so many upvotes here today. I don't remember that many people coming to mine and other people's defenses when we suggested the exact same thing a few months back and crypto gurus were rending their hair like we had committed the most stupidly blasphemous act conceivable to modern computer science.

mukyu 16y ago

http://www.networknotary.org/firefox.html http://www.networknotary.org/firefox.html https://addons.mozilla.org/en-us/firefox/addon/certificate-patrol/ https://addons.mozilla.org/en-us/firefox/addon/certificate-p...