4 ms·
Okay, so SSL dies. it's gone. Kaput. Now what? I get that a false sense of security is worse, but we haven't yet figured out a better way that is still decent
by ebiester 15y ago
Okay, so SSL dies. it's gone. Kaput.
Now what?
I get that a false sense of security is worse, but we haven't yet figured out a better way that is still decentralized and works with a wide variety of user skill levels.
Because people who aren't expert users deserve security too. And they deserve functionality.
- pointyhat 15y agoSSL was never decentralised. It was always centralised with CA's which is the issue. We need a reputation based, distributed public key architecture.
- tptacek 15y agoSo build one. Your preference actually has very little to do with the X509 CA architecture. Today we have a complex little forest of fiat CAs. No part of the TLS architecture prevents you from replacing that with an even more complex and more full-featured web of smaller CAs. I'm not being sarcastic. Your decentralized reputation scheme could very well be better than our severely compromised system of central CAs.
- pnathan 15y agopeople who aren't expert users deserve security too. And they deserve functionality. Well, SSL certainly isn't giving serious security in the "My ISP has been intruded" attack model. You can't have both security and ignorance. If you really want to be secure, you're going to have to learn how to be secure, and then to know how to implement it.
- tptacek 15y agoYour ISP can be completely compromised and SSL/TLS will continue to work, even in its broken incarnation in your browser configuration.
- pnathan 15y agoUmm. What do you mean by work? If my ISP injects certain proxies in my route, they can unwrap the encrypted communication.
- tptacek 15y agoNo they can't. That's not how TLS works. The problem we are talking about is not that SSL/TLS- the- protocol allows ISPs to decrypt traffic. It's that some browsers have been shipped with a certificate authority that is willing to sign Google CN's. Remove that CA's cert. What's your ISP going to do now?
- pnathan 15y agoA brief search for TLS MITM suggests to my inexperienced eye that there are indeed TLS attacks via MITM cert-swapping that the ISP can assert. --- edit. Not looking for argument. Looking for facts. - This is my top hit for 'tls mitm proxy' http://www.delegate.org/delegate/mitm/ http://www.delegate.org/delegate/mitm/ It's dated as '06, however. - I can install Fiddler (Windows https debugger) on my machine and read https traffic in the clear. - A competent admin assures me that Websense can read https traffic. Couldn't really dig real detail up on the websense sites though. This chap suggests the admin is not wrong (search for corporate, it's toward the end): http://www.carbonwind.net/blog/post/Random-SSLTLS-101%E2%80%93SSLTLS-version-rollbacks-and-browsers.aspx http://www.carbonwind.net/blog/post/Random-SSLTLS-101%E2%80%...
- tptacek 15y agoI have no idea how I might go about arguing with you; it's as if I were to argue "a brief search of the literature suggests that P is definitely NP". Give me something more specific and I'll give you the context behind it; right now, I don't know what you're talking about. (Sigh). Fiddler pops the browser certificate warning when you use it; it's not breaking TLS. You must just as productively say "my friend assures me AES is broken; maybe that's what Iran is doing." Just like your competent admin friend, there would be some reason for him to say that; it just wouldn't be relevant.
- ebiester 15y agoUse case 1: 60 year old man wants to access his bank online from his home. He has been using computer for 10 years, but only been using the internet actively for 5, and still requires help from IT for basic issues at work. Use case 2: 40 year old man wants to use his laptop from starbucks for email. He has used computers for much of his life, but doesn't really understand how it works. He is on the road working 60-80 hours a week. He is taught to VPN in to work, but that is the extent of his understanding of security. We're not talking about the use case 3: activist in Iran needs to communicate with compatriots. That is a much harder problem for which SSL is insufficient. How do we set up a sufficiently easy system for use cases 1 and 2? Charging them $1,000 for a 2 day class in security is not going to work in scale, and nobody has yet written a security primer for dummies past the most basic of "don't give people your password and don't use your dog's name."
- tptacek 15y agoThis is not true. There is no cryptosystem we know of that is more suited to "User Case 3" than TLS. There is a problem with the way activists in Iran are using TLS: to wit, they are trusting Mozilla, Microsoft, Apple, or Google to make decisions about who they trust. But TLS does not require them to do that. They are a point-and-click HOWTO away from not being in that position. If Iranian activists want to trust Google for their sensitive email, all they have to do is track down Google's authentic certificate (by asking anybody outside of Iran to fetch it) and add it to their browser. Iran does not have the ability to break RSA. All they (apparently) have the ability to do is to con incompetent CAs into making new RSA signatures that some browsers are configured to believe.