6 ms·

I understand the desire to use trust-on-first-use to get rid of certificate authorities (some of the most dispicable and untrustworthy organizations around, and

I understand the desire to use trust-on-first-use to get rid of certificate authorities (some of the most dispicable and untrustworthy organizations around, and the largest security hole in TLS). However trust-on-first-use basically hands any long-term man-in-the-middle a complete victory. Authoritarian regimes are going to require ISPs to mitm every connection from first use, and hand over whatever data is desired to the secret police. CAA, Key Pinning, certificate transparency all bring the risk of CA abuse way down without opening a huge new vector of ISP abuse.

ronsor 5y ago
Trust on first use combined with preloaded public key lists is the best of both worlds in my opinion. You may say that browsers made in authoritarian countries would sabotage the preload lists, but they could also bundle illegitimate CAs or break HTTPS in other ways anyway.
- jtl999 5y ago
  This. Some standards bodies (arguably) made a big deal about client certificates some time ago to reliably pin client identities for client->server connections (whether it worked is a different story), and I certainly think having functionality for the reverse (pinning server identities) should exist too. Doesn't have to be Gemini even, but I think getting buy in from browser vendors after the removal of HPKP is going to be a problem...
- judge2020 5y ago
  'HTTPS in other ways': https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-middle_attack https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-middle_a...
- Seirdy 5y ago
  Another option would be something similar to Go's sum database, but with something like a DHT instead of a hosted centralized service. Or perhaps instead of a DHT, users could export all their certs to a file and combine/compare entries in a grassroots manner with each other and with devices on different networks.
LeoPanthera 5y ago
People, or businesses, that you know in real life could exchange certificate hashes in person. This is one of those things that usually garners the response "normal people would never do that", but honestly I'm surprised that no-one has even tried. Let's say that web browsers put a short hash of the certificate right in the URL bar. Amazon, for example, could print its hash on every shipping box. Banks could print their hashes on plaques in every branch. Newspapers on their, well, newspapers. Media organizations could occasionally add them to their TV logos and radio jingles. And so on. There's any number of out-of-band channels available. For most sites, you actually wouldn't need to verify the hash anyway. You usually wouldn't care. But when you did care, I honestly think this isn't such a crazy idea.
- jdonaldson 5y ago
  It’s a good form of secondary support for authentication, and is a reasonable foothold to start expanding circles of trust (I.e. second hand trust.. or “trust what my trusted source trusts”).
- SilverRed 5y ago
  > People, or businesses, that you know in real life could exchange certificate hashes in person. This happens about as often as using PGP email. Approximately never.
  - LeoPanthera 5y ago
    This is the exact response that I tried to cover with the rest of my comment.
    - prox 5y ago
      I actually think it’s an interesting idea that merits some investigation.
      - WJW 5y ago
        My first idea is that it would be a nightmare from a supply chain security perspective. Eventually someone from the Amazon box printing company will be bribed to print a different certificate hash on 0.5% of the printed boxes, for example.
password4321 5y ago
SSH works.
- SilverRed 5y ago
  There is no government effort to MitM SSH. And if there was, it would immediately crumble because not a single person manually verifies their ssh connection.
- tptacek 5y ago
  SSH has a different service model; there aren’t masses of anonymous clients connecting to a typical SSH server, but rather deliberate 1:1 relationships, which is why the model works there. And still, high-security environments deploy certificate SSH, specifically to avoid this problem.
Lammy 5y ago
Personally I've come to believe none of it matters and that encryption is a total waste of time, at least for the kind of stuff I would want to publish using Gemini (long-form text) where there's nothing interactive or user-specific in any request. Just the act of making a network connection gives away who you are, where you are, when you are online, and what you're reading: https://kieranhealy.org/blog/archives/2013/06/09/using-metadata-to-find-paul-revere/ https://kieranhealy.org/blog/archives/2013/06/09/using-metad...
- sodality2 5y ago
  Restricting Gemini to just long-form text (one way consumption) is really reducing the possibilities Gemini can have, IMO. Though the whole minimalist attitude would probably preclude most of them.
  - alexwennerberg 5y ago
    > reducing the possibilities Gemini can have Gemini is all about reducing possibilities. If you want more possibilities, use the web IMO
    - sodality2 5y ago
      Fair. I certainly think that type of simplistic Gemini has a place in the world. But I think ">If you want more possibilities, use the web IMO" goes against the minimalist ethos of Gemini as well; I don't want something as bloated as the web, but perhaps I do want a comment section of my posts? I think that's not too bloated to be thrown in with the rest of the web. But it might very well be too bloated to throw into Gemini, which is reasonable. Footnote: An email alongside the post + the author editing the post with meaningful and thoughtful contributions could perhaps be a substitute.
      - alexwennerberg 5y ago
        With Gemini, the philosophy of intentional austerity means that everyone is going to be a bit unhappy, and want some feature added to it. Its "incompleteness" is a necessary consequence of its design philosophy -- it calls on us to accept it "as-is" rather than try and extend the spec. A mailing list for comments, as you describe, would be more "gemini philosophy". This is what the author does: => https://lists.sr.ht/~sircmpwn/public-inbox https://lists.sr.ht/~sircmpwn/public-inbox Mailing lists are a bit out of vogue, but there's no reason not to bring them back into vogue, at least for people sympathetic to Gemini's ideals.
_wldu 5y ago
SSH is TOFU.

ronsor 5y ago

Trust on first use combined with preloaded public key lists is the best of both worlds in my opinion. You may say that browsers made in authoritarian countries would sabotage the preload lists, but they could also bundle illegitimate CAs or break HTTPS in other ways anyway.

jtl999 5y ago
This. Some standards bodies (arguably) made a big deal about client certificates some time ago to reliably pin client identities for client->server connections (whether it worked is a different story), and I certainly think having functionality for the reverse (pinning server identities) should exist too. Doesn't have to be Gemini even, but I think getting buy in from browser vendors after the removal of HPKP is going to be a problem...
judge2020 5y ago
'HTTPS in other ways': https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-middle_attack https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-middle_a...
Seirdy 5y ago
Another option would be something similar to Go's sum database, but with something like a DHT instead of a hosted centralized service. Or perhaps instead of a DHT, users could export all their certs to a file and combine/compare entries in a grassroots manner with each other and with devices on different networks.

LeoPanthera 5y ago

People, or businesses, that you know in real life could exchange certificate hashes in person. This is one of those things that usually garners the response "normal people would never do that", but honestly I'm surprised that no-one has even tried. Let's say that web browsers put a short hash of the certificate right in the URL bar. Amazon, for example, could print its hash on every shipping box. Banks could print their hashes on plaques in every branch. Newspapers on their, well, newspapers. Media organizations could occasionally add them to their TV logos and radio jingles. And so on. There's any number of out-of-band channels available. For most sites, you actually wouldn't need to verify the hash anyway. You usually wouldn't care. But when you did care, I honestly think this isn't such a crazy idea.

jdonaldson 5y ago
It’s a good form of secondary support for authentication, and is a reasonable foothold to start expanding circles of trust (I.e. second hand trust.. or “trust what my trusted source trusts”).
SilverRed 5y ago
> People, or businesses, that you know in real life could exchange certificate hashes in person. This happens about as often as using PGP email. Approximately never.
- LeoPanthera 5y ago
  This is the exact response that I tried to cover with the rest of my comment.
  - prox 5y ago
    I actually think it’s an interesting idea that merits some investigation.
    - WJW 5y ago
      My first idea is that it would be a nightmare from a supply chain security perspective. Eventually someone from the Amazon box printing company will be bribed to print a different certificate hash on 0.5% of the printed boxes, for example.

password4321 5y ago

SSH works.

SilverRed 5y ago
There is no government effort to MitM SSH. And if there was, it would immediately crumble because not a single person manually verifies their ssh connection.
tptacek 5y ago
SSH has a different service model; there aren’t masses of anonymous clients connecting to a typical SSH server, but rather deliberate 1:1 relationships, which is why the model works there. And still, high-security environments deploy certificate SSH, specifically to avoid this problem.

Lammy 5y ago

Personally I've come to believe none of it matters and that encryption is a total waste of time, at least for the kind of stuff I would want to publish using Gemini (long-form text) where there's nothing interactive or user-specific in any request. Just the act of making a network connection gives away who you are, where you are, when you are online, and what you're reading: https://kieranhealy.org/blog/archives/2013/06/09/using-metadata-to-find-paul-revere/ https://kieranhealy.org/blog/archives/2013/06/09/using-metad...

sodality2 5y ago
Restricting Gemini to just long-form text (one way consumption) is really reducing the possibilities Gemini can have, IMO. Though the whole minimalist attitude would probably preclude most of them.
- alexwennerberg 5y ago
  > reducing the possibilities Gemini can have Gemini is all about reducing possibilities. If you want more possibilities, use the web IMO
  - sodality2 5y ago
    Fair. I certainly think that type of simplistic Gemini has a place in the world. But I think ">If you want more possibilities, use the web IMO" goes against the minimalist ethos of Gemini as well; I don't want something as bloated as the web, but perhaps I do want a comment section of my posts? I think that's not too bloated to be thrown in with the rest of the web. But it might very well be too bloated to throw into Gemini, which is reasonable. Footnote: An email alongside the post + the author editing the post with meaningful and thoughtful contributions could perhaps be a substitute.
    - alexwennerberg 5y ago
      With Gemini, the philosophy of intentional austerity means that everyone is going to be a bit unhappy, and want some feature added to it. Its "incompleteness" is a necessary consequence of its design philosophy -- it calls on us to accept it "as-is" rather than try and extend the spec. A mailing list for comments, as you describe, would be more "gemini philosophy". This is what the author does: => https://lists.sr.ht/~sircmpwn/public-inbox https://lists.sr.ht/~sircmpwn/public-inbox Mailing lists are a bit out of vogue, but there's no reason not to bring them back into vogue, at least for people sympathetic to Gemini's ideals.

_wldu 5y ago

SSH is TOFU.