4 ms·

You can have it today! No money or plugins needed. And it only takes a minute to get started. Just delete your CA list. Go into your browser's preferences. Fi

You can have it today! No money or plugins needed. And it only takes a minute to get started. Just delete your CA list. Go into your browser's preferences. Find the "security" section. It should have a button to open up the list of trusted certificate authorities. Delete them all. Now, every time you connect to a secure page, one of two things will happen: 1. If you've never visited that page before, your browser will prompt you for instructions. Use whatever means you like (second browser, remote server, call them, etc) to verify the server's SSL fingerprint. If it checks out, mark it as valid (aka "add an exception"). 2. If you have visited that site before, its exception will already be present in your browser, and it will work like normal. After a few days of this, you'll see why the SSH model hasn't seen widespread adoption for HTTPS.

huhtenberg 16y ago
Ha-ha-ha. Not too practical, is it? There are my own servers and there is the rest of the Internet. I want to use self-signed certs on my servers and I want these to be sticky. If any of these servers would suddenly start presenting different certificates (most notably, signed by a CA that sits on browser's trusted list), I want to know about this lovely fact. For the rest of the Internet I can live with existing PKI.
- caf 16y ago
  That plugin already exists - if you run Firefox, install "Certificate Patrol". It will tell you whenever a site's certificate changes, and it'll show the relevant fields of the old and new certificates side-by-side, so that you can decide whether the change looks benign or malignant.
Udo 16y ago
What you describe is exactly the behavior the author calls "Firefox' war on self-signed certificates". The actual proposal calls for a browser that does NOT prompt the user all the time. It would just prompt when something extraordinary happens (such as the server's already known certificate changing). > After a few days of this, you'll see why the SSH model hasn't seen widespread adoption for HTTPS That's not really true. It has simply never been done for browsers, because many people think it's an abomination and, to paraphrase well-known HNers from previous discussions, supposedly useless and little more than obfuscation instead of encryption. It's not the first time TOFU/POP has been suggested on HN, too. I find it curious this proposal got so many upvotes here today. I don't remember that many people coming to mine and other people's defenses when we suggested the exact same thing a few months back and crypto gurus were rending their hair like we had committed the most stupidly blasphemous act conceivable to modern computer science.
- jmillikin 16y ago
  The first time you connect to an SSH server, your client will display that server's key, and prompt for instructions. Notably, SSH will not automatically connect. It asks first. That's why it's useful. Additionally, SSH is such a niche tool that its users can be expected to be security-minded -- for example, by checking that the fingerprint matches the expected string instead of just clicking through. If browsers automatically trusted a page the first time they hit, attackers can just redirect the user to http://paypa1.com/ http://paypa1.com/ and feed them a fancy, green-url certificate.
  - Udo 16y ago
    Replicating SSH's UI is not the point here. > Notably, SSH will not automatically connect. It asks first. That's why it's useful. How many sysadmins really do check their newly installed server's fingerprint? They just type "yes" on first connect and grab the server's certificate. I believe very few people actually do manual loopups when SSH pops the first-connection warning. Most hosting providers will send you cleartext passwords for your server by email. When you log onto that server for the first time, there is no easy way to tell if you're the victim of an elaborate MITM attack. So that's happening right now. > If browsers automatically trusted a page the first time they hit, attackers can just redirect the user to http://paypa1.com/ http://paypa1.com/ and feed them a fancy, green-url certificate. Indeed they can. Nobody's suggesting otherwise. By the way, I can do that today, by registering a cert for paypa1.com, just to see how many people actually take a second look at the content of the certificate.
    - tptacek 16y ago
      You really need to start looking more carefully at those SSH messages. In particular, the fact that you get an SSH warning when a site's key suddenly changes is 99% of the security value of SSH. It was an old Usenix conference trick --- I think it's Dug Song's, but I'm not really sure --- to snarf people's SSH logins by capitalizing on their lack of interest in those messages. It's a trivial attack.
      - 16y ago
kahawe 16y ago
Ever since they changed Firefox's behavior when an unknown certificate is encountered this would be especially crippling. I can understand why this might be a good feature to have for end-users and internet novices but why isn't there an option to revert it back to the old "yes/no" box instead of having to click 5 times when I know exactly why there is a self-signed certificate in use... Also, considering this: > Global PKI, as currently implemented in browsers, does not work. makes this feature even more dubious and even worse, together with the green SSL indicator it gives a false sense of security.
- Silhouette 16y ago
  > Ever since they changed Firefox's behavior when an unknown certificate is encountered this would be especially crippling. Yes, that is possibly the single most annoying thing about any piece of software ever written, at least for those of us who develop secured web sites (and therefore self-sign all kinds of stuff before going to production).
  - omh 16y ago
    If it causes that much irritation, have you considered making your own CA, adding it to your browsers, and then using that to sign your temporary certificates? It's quite straightforward to do this with openssl.
    - Silhouette 16y ago
      I suppose that would be a possibility, but we'd still have to configure every browser on every machine to support that CA and then generate a certificate for every new project. I'd rather just be able to click once in my browser to accept the unsigned certificate, instead of jumping through tedious hoops that I don't believe really help anyone.
      - acdha 16y ago
        So rather than click once to install your internal CA you'd prefer to click once for every new site you add?

huhtenberg 16y ago

Ha-ha-ha. Not too practical, is it? There are my own servers and there is the rest of the Internet. I want to use self-signed certs on my servers and I want these to be sticky. If any of these servers would suddenly start presenting different certificates (most notably, signed by a CA that sits on browser's trusted list), I want to know about this lovely fact. For the rest of the Internet I can live with existing PKI.

caf 16y ago
That plugin already exists - if you run Firefox, install "Certificate Patrol". It will tell you whenever a site's certificate changes, and it'll show the relevant fields of the old and new certificates side-by-side, so that you can decide whether the change looks benign or malignant.

Udo 16y ago

What you describe is exactly the behavior the author calls "Firefox' war on self-signed certificates". The actual proposal calls for a browser that does NOT prompt the user all the time. It would just prompt when something extraordinary happens (such as the server's already known certificate changing). > After a few days of this, you'll see why the SSH model hasn't seen widespread adoption for HTTPS That's not really true. It has simply never been done for browsers, because many people think it's an abomination and, to paraphrase well-known HNers from previous discussions, supposedly useless and little more than obfuscation instead of encryption. It's not the first time TOFU/POP has been suggested on HN, too. I find it curious this proposal got so many upvotes here today. I don't remember that many people coming to mine and other people's defenses when we suggested the exact same thing a few months back and crypto gurus were rending their hair like we had committed the most stupidly blasphemous act conceivable to modern computer science.

jmillikin 16y ago
The first time you connect to an SSH server, your client will display that server's key, and prompt for instructions. Notably, SSH will not automatically connect. It asks first. That's why it's useful. Additionally, SSH is such a niche tool that its users can be expected to be security-minded -- for example, by checking that the fingerprint matches the expected string instead of just clicking through. If browsers automatically trusted a page the first time they hit, attackers can just redirect the user to http://paypa1.com/ http://paypa1.com/ and feed them a fancy, green-url certificate.
- Udo 16y ago
  Replicating SSH's UI is not the point here. > Notably, SSH will not automatically connect. It asks first. That's why it's useful. How many sysadmins really do check their newly installed server's fingerprint? They just type "yes" on first connect and grab the server's certificate. I believe very few people actually do manual loopups when SSH pops the first-connection warning. Most hosting providers will send you cleartext passwords for your server by email. When you log onto that server for the first time, there is no easy way to tell if you're the victim of an elaborate MITM attack. So that's happening right now. > If browsers automatically trusted a page the first time they hit, attackers can just redirect the user to http://paypa1.com/ http://paypa1.com/ and feed them a fancy, green-url certificate. Indeed they can. Nobody's suggesting otherwise. By the way, I can do that today, by registering a cert for paypa1.com, just to see how many people actually take a second look at the content of the certificate.
  - tptacek 16y ago
    You really need to start looking more carefully at those SSH messages. In particular, the fact that you get an SSH warning when a site's key suddenly changes is 99% of the security value of SSH. It was an old Usenix conference trick --- I think it's Dug Song's, but I'm not really sure --- to snarf people's SSH logins by capitalizing on their lack of interest in those messages. It's a trivial attack.
    - 16y ago

kahawe 16y ago

Ever since they changed Firefox's behavior when an unknown certificate is encountered this would be especially crippling. I can understand why this might be a good feature to have for end-users and internet novices but why isn't there an option to revert it back to the old "yes/no" box instead of having to click 5 times when I know exactly why there is a self-signed certificate in use... Also, considering this: > Global PKI, as currently implemented in browsers, does not work. makes this feature even more dubious and even worse, together with the green SSL indicator it gives a false sense of security.

Silhouette 16y ago
> Ever since they changed Firefox's behavior when an unknown certificate is encountered this would be especially crippling. Yes, that is possibly the single most annoying thing about any piece of software ever written, at least for those of us who develop secured web sites (and therefore self-sign all kinds of stuff before going to production).
- omh 16y ago
  If it causes that much irritation, have you considered making your own CA, adding it to your browsers, and then using that to sign your temporary certificates? It's quite straightforward to do this with openssl.
  - Silhouette 16y ago
    I suppose that would be a possibility, but we'd still have to configure every browser on every machine to support that CA and then generate a certificate for every new project. I'd rather just be able to click once in my browser to accept the unsigned certificate, instead of jumping through tedious hoops that I don't believe really help anyone.
    - acdha 16y ago
      So rather than click once to install your internal CA you'd prefer to click once for every new site you add?