4 ms·

Pinning and certificate transparency help a lot. Chrome errors out on TLS certificates that aren't in the certificate transparency log, so an attacker merely ha

Pinning and certificate transparency help a lot. Chrome errors out on TLS certificates that aren't in the certificate transparency log, so an attacker merely having a trusted CA is insufficient to silently MITM traffic.

xg15 5y ago
Yes, it will show up in the CT logs, but so what? This assumes everyone is watching the CT logs and is able to distinguish expected from unexpected entries. And until the entry is discovered, they can still MITM traffic. But with CT logs, why do we need CAs at all? After all, an ACME-capable CA cannot verify anything else than that I control the site's DNS record at that particular point in time (from the PoV of wherever the CA's servers are located) But that kind of validation could just as well be performed by the CT log directly. It seems to me, the real SPOF are DNS registrars. The authoritarian government (or some disgruntled employee of the registrar) could just force the registrar to hand over control of my DNS record to them, point it to their own server and ask LE to hand them a brand new certificate.
- sneak 5y ago
  DNS is totally unauthenticated. It's the NSPs/ISPs you have to worry about, and they are already in bed with the covert spying apparatus of the state. See also: QUANTUMINSERT
  - xg15 5y ago
    No, HTTPS with ACME certs protects well against that particular threat model: The CA runs the challenge from their own servers and contacts the registrar directly. That exchange completely bypasses my ISP. A bad ISP still can intercept my DNS queries and point my browser to an MITM server - but it cannot intercept the CA's query and therefore cannot complete the challenge. So they can't obtain the certificate their MITM proxy would need. DoH goes one step further (in theory) : When enabled, my own DNS queries are proxied to Cloudflare, so my ISP cant even intercept those anymore. The downside of ACME is just that if someone manages to manipulate the record that is actually stored at the registrar, they get the ability to stamp themselves valid HTTPS certificates for that domain for free. Doesn't even matter which CA the site owner uses, they can alway get a Let's Encrypt cert that will be accepted by all browsers.
    - sneak 5y ago
      > The CA runs the challenge from their own servers and contacts the registrar directly. No, they contact it via the internet, which is controlled by the national authorities in the countries between the CA and the DNS server (which you are calling the registrar, but isn't always). It's not a direct connection; there are NSPs in between.
      - xg15 5y ago
        This is true, but the CA does not have to disclose where on the network their servers are located or which network path the validation requests will take. Let's Encrypt sends queries from multiple servers that use different NSPs to make this kind of attack harder. (what they call "multi-perspective validation"[1]) To spoof a challange, an attacker would first have to find out where the servers are located, then compromise all relevant autonomous systems and intercept the reqests from each server. I admit though, it's still a risk. An attacker can pick an arbitrary CA for spoofing - so even if Let's Encrypt does their homework, maybe some other free CA has a less secure ACME implementation. [1] https://letsencrypt.org/2018/12/31/looking-forward-to-2019.html#new-features https://letsencrypt.org/2018/12/31/looking-forward-to-2019.h...
Anunayj 5y ago
Wait How does that work, I often use a self signed (locally trusted) cert for intercepting traffic, and do not get any Error Messages, Does it check CT logs for only bundled certs?

xg15 5y ago

Yes, it will show up in the CT logs, but so what? This assumes everyone is watching the CT logs and is able to distinguish expected from unexpected entries. And until the entry is discovered, they can still MITM traffic. But with CT logs, why do we need CAs at all? After all, an ACME-capable CA cannot verify anything else than that I control the site's DNS record at that particular point in time (from the PoV of wherever the CA's servers are located) But that kind of validation could just as well be performed by the CT log directly. It seems to me, the real SPOF are DNS registrars. The authoritarian government (or some disgruntled employee of the registrar) could just force the registrar to hand over control of my DNS record to them, point it to their own server and ask LE to hand them a brand new certificate.

sneak 5y ago
DNS is totally unauthenticated. It's the NSPs/ISPs you have to worry about, and they are already in bed with the covert spying apparatus of the state. See also: QUANTUMINSERT
- xg15 5y ago
  No, HTTPS with ACME certs protects well against that particular threat model: The CA runs the challenge from their own servers and contacts the registrar directly. That exchange completely bypasses my ISP. A bad ISP still can intercept my DNS queries and point my browser to an MITM server - but it cannot intercept the CA's query and therefore cannot complete the challenge. So they can't obtain the certificate their MITM proxy would need. DoH goes one step further (in theory) : When enabled, my own DNS queries are proxied to Cloudflare, so my ISP cant even intercept those anymore. The downside of ACME is just that if someone manages to manipulate the record that is actually stored at the registrar, they get the ability to stamp themselves valid HTTPS certificates for that domain for free. Doesn't even matter which CA the site owner uses, they can alway get a Let's Encrypt cert that will be accepted by all browsers.
  - sneak 5y ago
    > The CA runs the challenge from their own servers and contacts the registrar directly. No, they contact it via the internet, which is controlled by the national authorities in the countries between the CA and the DNS server (which you are calling the registrar, but isn't always). It's not a direct connection; there are NSPs in between.
    - xg15 5y ago
      This is true, but the CA does not have to disclose where on the network their servers are located or which network path the validation requests will take. Let's Encrypt sends queries from multiple servers that use different NSPs to make this kind of attack harder. (what they call "multi-perspective validation"[1]) To spoof a challange, an attacker would first have to find out where the servers are located, then compromise all relevant autonomous systems and intercept the reqests from each server. I admit though, it's still a risk. An attacker can pick an arbitrary CA for spoofing - so even if Let's Encrypt does their homework, maybe some other free CA has a less secure ACME implementation. [1] https://letsencrypt.org/2018/12/31/looking-forward-to-2019.html#new-features https://letsencrypt.org/2018/12/31/looking-forward-to-2019.h...

Anunayj 5y ago

Wait How does that work, I often use a self signed (locally trusted) cert for intercepting traffic, and do not get any Error Messages, Does it check CT logs for only bundled certs?