4 ms·

Compromising Certificate Authorities and various root endpoints is probably what’s is done since https became ubiquitous.

by aborsy 5y ago

fguerraz 5y ago
That is way too obvious and I doubt any western country would do it on their homeland, the political risk is just too big.
- kongin 5y ago
  You both overestimate and underestimate the intelligence of intelligence agencies.
  - fguerraz 5y ago
    I'm not saying they can't pull it off, but why use this method that is very detectable when you can use others that are transparent to the user (see my other comment)?
- bigiain 5y ago
  Yeah. You don’t do this to your own country people. You get one of your five eyes friends to do it for you.
- endymi0n 5y ago
  It‘s not exactly like there‘s no precedent… https://news.ycombinator.com/item?id=9076351 https://news.ycombinator.com/item?id=9076351
tinus_hn 5y ago
Compromising certificate authorities does not help in decrypting the data that is transmitted unless it is an active attack that modifies data.
tialaramex 5y ago
Because we have Certificate Transparency the evidence if this was happening is publicly available (whereas without CT it's just given to everybody connecting to this hypothetical bogus server) So, where's the evidence? Without CT you could imagine that the spooks are snooping on everybody else and that's why you don't have any evidence -- they knew you were too smart, but with CT you can go look for evidence they snooped your grandmother's online bingo or your second cousin's Trump fandom forum, and well, seems like there just isn't any. The Russians don't care if they're known to be doing crimes, that's why they sent assassins to England to murder an ex-spy and then offered the most stupid transparent lie about the men being "tourists". But the NSA is kinda sensitive about this stuff, they like plausible deniability. So, why would they choose a method that provides a signed paper trail proving they did it?
- aborsy 5y ago
  This is simplistic. The security is found to be sometimes lax with these CAs. There have also been problems with audits, CTs and paper trail. I recommend this episode of the following podcast on security of CAs: https://securitycryptographywhatever.buzzsprout.com/1822302/9146390-how-to-be-a-certificate-authority-feat-ryan-sleevi https://securitycryptographywhatever.buzzsprout.com/1822302/... CTs help, but you really have to see who is behind them and how they are operated. It’s known that hacking companies run CAs, accepted by Firefox and Chrome (at least for a period of time).
  - tgsovlerkhgsel 5y ago
    The beautiful thing with CT is that there will always be a paper trail. Either the certificate is included in the CT log, then the web site operator can notice that an illegitimate certificate was issued. This makes this approach risky, and infeasible against big services (since they presumably monitor CT logs for misissuances for their domains). Or it isn't included in the CT log, then the certificate itself is a digitally signed admission of incompetence by the CA, and IIRC at least some browsers will reject the certificate if it doesn't have a CT receipt (SCT) from at least one accepted log. The remaining options would be to compromise (or compel) an accepted CT log to issue SCTs without recording the certificate. This would require attacking two entities, and if caught (i.e. the victim noticed the cert wasn't in CT), would mean the end of the log. These do not guarantee that such an attack will be discovered or stopped, but let's not pretend that these didn't massively raise the stakes for attacks against CAs. Previously, if an intelligence service could get a CA to misissue a certificate, they could only be caught if the victim identified the certificate as misissued, stored a copy, and even then it'd become a he-said-she-said.

Compromising Certificate Authorities and various root endpoints is probably what’s is done since https became ubiquitous.

by aborsy 5y ago

Compromising Certificate Authorities and various root endpoints is probably what’s is done since https became ubiquitous.

fguerraz 5y ago

That is way too obvious and I doubt any western country would do it on their homeland, the political risk is just too big.

kongin 5y ago
You both overestimate and underestimate the intelligence of intelligence agencies.
- fguerraz 5y ago
  I'm not saying they can't pull it off, but why use this method that is very detectable when you can use others that are transparent to the user (see my other comment)?
bigiain 5y ago
Yeah. You don’t do this to your own country people. You get one of your five eyes friends to do it for you.
endymi0n 5y ago
It‘s not exactly like there‘s no precedent… https://news.ycombinator.com/item?id=9076351 https://news.ycombinator.com/item?id=9076351

tinus_hn 5y ago

Compromising certificate authorities does not help in decrypting the data that is transmitted unless it is an active attack that modifies data.

tialaramex 5y ago

Because we have Certificate Transparency the evidence if this was happening is publicly available (whereas without CT it's just given to everybody connecting to this hypothetical bogus server) So, where's the evidence? Without CT you could imagine that the spooks are snooping on everybody else and that's why you don't have any evidence -- they knew you were too smart, but with CT you can go look for evidence they snooped your grandmother's online bingo or your second cousin's Trump fandom forum, and well, seems like there just isn't any. The Russians don't care if they're known to be doing crimes, that's why they sent assassins to England to murder an ex-spy and then offered the most stupid transparent lie about the men being "tourists". But the NSA is kinda sensitive about this stuff, they like plausible deniability. So, why would they choose a method that provides a signed paper trail proving they did it?

aborsy 5y ago
This is simplistic. The security is found to be sometimes lax with these CAs. There have also been problems with audits, CTs and paper trail. I recommend this episode of the following podcast on security of CAs: https://securitycryptographywhatever.buzzsprout.com/1822302/9146390-how-to-be-a-certificate-authority-feat-ryan-sleevi https://securitycryptographywhatever.buzzsprout.com/1822302/... CTs help, but you really have to see who is behind them and how they are operated. It’s known that hacking companies run CAs, accepted by Firefox and Chrome (at least for a period of time).
- tgsovlerkhgsel 5y ago
  The beautiful thing with CT is that there will always be a paper trail. Either the certificate is included in the CT log, then the web site operator can notice that an illegitimate certificate was issued. This makes this approach risky, and infeasible against big services (since they presumably monitor CT logs for misissuances for their domains). Or it isn't included in the CT log, then the certificate itself is a digitally signed admission of incompetence by the CA, and IIRC at least some browsers will reject the certificate if it doesn't have a CT receipt (SCT) from at least one accepted log. The remaining options would be to compromise (or compel) an accepted CT log to issue SCTs without recording the certificate. This would require attacking two entities, and if caught (i.e. the victim noticed the cert wasn't in CT), would mean the end of the log. These do not guarantee that such an attack will be discovered or stopped, but let's not pretend that these didn't massively raise the stakes for attacks against CAs. Previously, if an intelligence service could get a CA to misissue a certificate, they could only be caught if the victim identified the certificate as misissued, stored a copy, and even then it'd become a he-said-she-said.