3 ms·

Wow, I haven't thought about GRC in a long time. I've always thought the guy was somewhat of a crackpot/sensationalist/self-promoter because he seemed to have

Wow, I haven't thought about GRC in a long time. I've always thought the guy was somewhat of a crackpot/sensationalist/self-promoter because he seemed to have a standard recipe of finding some interesting-to-him feature/aspect of a system and then declaring it a glaring security problem and then writing sensationalized screeds about how everyone needs to use his utilities to protect themselves from it (I swear, he probably shouted about the world ending because of XP raw sockets for a decade longer than it was even relevant). I kind of liked SQRL as a concept but I also remember thinking, "ugh, but it's this guy". He seems to have a decent amount of technical knowledge but a lot of what he writes just seems to be about a need to be considered an expert at something, aimed at people who don't know any better. Just as an example, the idea of people referring to his web page [1] to validate the cert fingerprints of popular websites is ... really bizarre from a security standpoint. I understand him having concern (as do many of us) about the security of the CA hierarchy, but where did he get the fingerprints? How did he validate them? And why should anyone trust him to have done so? Is his web page more secure than the CAs? [1] https://www.grc.com/fingerprints.htm https://www.grc.com/fingerprints.htm ... but I digress. Apparently I have some very strong skepticism of Steve Gibson that I wasn't even aware of until I had a visceral reaction to ShieldsUp! (which is probably a perfectly fine service) :D

tialaramex 6y ago
The word that comes to mind for Steve Gibson is "kook". Not in a nasty way, just the sort of person who keeps sending purported proofs of the abc conjecture to a University mathematics professor they met briefly twenty years ago, or who frequently writes to their senator with opinions about a show they saw on TV. Harmless yet somehow mildly annoying. But as to that fingerprints page. The idea isn't really about any problem with the Web PKI (what you're calling "the CA hierarchy"). Instead it's about a method you can try to use to figure out if you're using a client that's configured to trust something else entirely. In most cases this means a middlebox, maybe at a school (to stop kids looking at porn and maybe cheating on tests) or at work (porn again, and maybe other non-work stuff, sometimes anti-exfiltration technology) but it could be your own AV software. It can't really do what it says on the tin, for a few reasons. You're going to get some false alerts this way because the certificate Steve (and Steve's web site) sees won't necessarily match the one you see, and if a sophisticated adversary was trying to defeat Steve's system they could just use the same technique to replace Steve's own site. Also as often happens with these little projects, it isn't properly maintained. The stuff about EV in Firefox (and I think Chrome too?) is no longer true.
- hamburglar 6y ago
  Ah, you're right, I didn't actually read through the alarmist stuff to see that he was referring to MITM proxies that actually install their own roots on your machines. Now I'm amused at the idea that there could be some off the shelf MITM proxy out there that simply does content editing to replace any occurrences of the FP of the real cert they're MITM'ing with the FP of the cert they generated for you on the fly. :D When I saw the alarmist stuff about knowing the cert fingerprints for certain sites a priori, I thought he'd invented a crazy ad hoc version of cert pinning and just rolled my eyes.
wnevets 6y ago
Ultimately Gibson was proven correct about raw sockets on Windows and they were removed a few years later [1] [1] http://www.interact-sw.co.uk/iangblog/2004/08/12/norawsockets http://www.interact-sw.co.uk/iangblog/2004/08/12/norawsocket...
- kayfox 6y ago
  The removal of raw sockets in XP SP2 did not prove Steve Gibson anything, as he had predicted the internet would become unusable with raw sockets in Windows, which it did not.
  - wnevets 6y ago
    So why did Microsoft reverse course in the next service pack after their release?
    - hamburglar 6y ago
      No idea, but linux has had raw sockets capabilities for its entire existence and the internet continues to exist. People have the ability to put arbitrary packets out on their network interfaces. The fact that some operating systems don't directly assist you in doing this is not a security feature. Edit: (and the fact that Gibson doesn't understand this is one reason people think he's a kook)
      - wnevets 6y ago
        You dont think XP having ~90% market share at the time and being easily exploitable makes comparing it to linux a little silly?
        hamburglar 6y ago
        If that were the only argument, then yes, at the time it would have been a pretty weak refutation. But even at the time, it was obvious to anyone who really understands security that relying on the bad actor's own OS to prevent them from launching attacks is a losing strategy. This was an overblown non-issue. The linux comparison is simply another demonstration of it.

tialaramex 6y ago

The word that comes to mind for Steve Gibson is "kook". Not in a nasty way, just the sort of person who keeps sending purported proofs of the abc conjecture to a University mathematics professor they met briefly twenty years ago, or who frequently writes to their senator with opinions about a show they saw on TV. Harmless yet somehow mildly annoying. But as to that fingerprints page. The idea isn't really about any problem with the Web PKI (what you're calling "the CA hierarchy"). Instead it's about a method you can try to use to figure out if you're using a client that's configured to trust something else entirely. In most cases this means a middlebox, maybe at a school (to stop kids looking at porn and maybe cheating on tests) or at work (porn again, and maybe other non-work stuff, sometimes anti-exfiltration technology) but it could be your own AV software. It can't really do what it says on the tin, for a few reasons. You're going to get some false alerts this way because the certificate Steve (and Steve's web site) sees won't necessarily match the one you see, and if a sophisticated adversary was trying to defeat Steve's system they could just use the same technique to replace Steve's own site. Also as often happens with these little projects, it isn't properly maintained. The stuff about EV in Firefox (and I think Chrome too?) is no longer true.

hamburglar 6y ago
Ah, you're right, I didn't actually read through the alarmist stuff to see that he was referring to MITM proxies that actually install their own roots on your machines. Now I'm amused at the idea that there could be some off the shelf MITM proxy out there that simply does content editing to replace any occurrences of the FP of the real cert they're MITM'ing with the FP of the cert they generated for you on the fly. :D When I saw the alarmist stuff about knowing the cert fingerprints for certain sites a priori, I thought he'd invented a crazy ad hoc version of cert pinning and just rolled my eyes.

wnevets 6y ago

Ultimately Gibson was proven correct about raw sockets on Windows and they were removed a few years later [1] [1] http://www.interact-sw.co.uk/iangblog/2004/08/12/norawsockets http://www.interact-sw.co.uk/iangblog/2004/08/12/norawsocket...

kayfox 6y ago
The removal of raw sockets in XP SP2 did not prove Steve Gibson anything, as he had predicted the internet would become unusable with raw sockets in Windows, which it did not.
- wnevets 6y ago
  So why did Microsoft reverse course in the next service pack after their release?
  - hamburglar 6y ago
    No idea, but linux has had raw sockets capabilities for its entire existence and the internet continues to exist. People have the ability to put arbitrary packets out on their network interfaces. The fact that some operating systems don't directly assist you in doing this is not a security feature. Edit: (and the fact that Gibson doesn't understand this is one reason people think he's a kook)
    - wnevets 6y ago
      You dont think XP having ~90% market share at the time and being easily exploitable makes comparing it to linux a little silly?
      - hamburglar 6y ago
        If that were the only argument, then yes, at the time it would have been a pretty weak refutation. But even at the time, it was obvious to anyone who really understands security that relying on the bad actor's own OS to prevent them from launching attacks is a losing strategy. This was an overblown non-issue. The linux comparison is simply another demonstration of it.