4 ms·

I don't know, it still seems better to me than our current situation which is 300 attack surfaces that are all effectively .

I don't know, it still seems better to me than our current situation which is 300 attack surfaces that are all effectively *.*

throwaway32 15y ago
its much worse than that, there are an unknown amount of intermediate CAs that also have this abillity. Several CAs sell these certs freely. So not only can one of the 300 CAs get compromised and totally destroy ssl security, so can a large amount of people you have _no information about at all_.
bdonlan 15y ago
It's also a LOT easier to recover from a key breach - you expire the old *.com certificate, and publish a new one under the root. No problem. The root key, of course, must be VERY carefully guarded - but since updates are infrequent, this can happen on an isolated system with no network connection (or even more paranoid systems, such as secret sharing schemes...)
- tptacek 15y ago
  You can recover from a breach like Diginotar's instantly; just remove their cert from your browser. You have no control over .COM's recovery from a breach.
tptacek 15y ago
You or I can point or click our way through dealing with a breach of a TLS certificate. Tell me what you'd personally do to deal with a rumored breach or misuse of .COM? Remember: under DNSSEC, Libya would have been BIT.LY's CA.
- caf 15y ago
  under DNSSEC, Libya would have been BIT.LY's CA. True, but at least it says that prominently on the tin.
  - tptacek 15y ago
    I don't know you, so please don't take too much offense to this, but isn't that sentiment simply batshit crazy? "Sure, DNSSEC literally bakes an implicit trust in world governments into the core security model of the entire Internet, but at least it's up front about it!" Please understand this: you can stop trusting every HTTPS/SSL CA today, and, as you visit HTTPS sites, accept their keys individually. There is absolutely no reason whatsoever for anyone to settle on this point, either with negligent corporations or with governments.
    - caf 15y ago
      No, that was not my point. My point is the advantage here is that the name "BIT.LY" itself clearly says who you are trusting to certify that name: You are trusting ".LY". If you do not trust ".LY", you can go about your day ignoring "∗.LY" sites, and your ability to separately trust "∗.NO" is unaffected. The fact that governments ultimately control most of these trust domains is unfortunate, but it is still nice to be able to have different trust domains. If I want to actually see the unedited propaganda of the Libyan government, then I sure as hell do trust the Libyan government the most to deliver that; conversely, I trust the US Government the most to certify that I'm actually browsing whitehouse.gov. Such a model allows me to see when I am browsing the Libyan-government-guaranteed part of the Internet - I know that any lies I read are Libyan government lies, and if my pockets are fleeced they will be fleeced with Libyan government complicity or incompetence. And sure, it'd be great if governments didn't have a monopoly - if there was, say, a Google-guaranteed part of the Internet too. This isn't too crucial, though: ultimately, all corporations are answerable to at least one government, that can compel the corporation to act in the interest of that government. By trusting Verisign I'm already trusting the US Government - it's just hidden.
      - tptacek 15y ago
        Why should anybody's choice of names determine whether their users can trust SSL?
        15y ago
- soult 15y ago
  > Remember: under DNSSEC, Libya would have been BIT.LY's CA. Remember: With or without DNSSEC Libya sets falsified MX records for bit.ly, buys a certificate (without any hacking), because after all, a valid SSL certificate for domain.example means that someone verified that you indeed receive mail for webmaster@domain.example, and also suddenly has a certificate for Bit.ly. This has been critized by Kaminsky and other researchers for ages now. I know you love SSL. In fact, I like SSL too. But please stop advertising the CA system along with it, because it is horribly broken.
  - tptacek 15y ago
    You and I agree about the CA system. SSL admits to things other than the CA system, like notary servers.

I don't know, it still seems better to me than our current situation which is 300 attack surfaces that are all effectively *.*

throwaway32 15y ago

its much worse than that, there are an unknown amount of intermediate CAs that also have this abillity. Several CAs sell these certs freely. So not only can one of the 300 CAs get compromised and totally destroy ssl security, so can a large amount of people you have _no information about at all_.

bdonlan 15y ago

It's also a LOT easier to recover from a key breach - you expire the old *.com certificate, and publish a new one under the root. No problem. The root key, of course, must be VERY carefully guarded - but since updates are infrequent, this can happen on an isolated system with no network connection (or even more paranoid systems, such as secret sharing schemes...)

tptacek 15y ago
You can recover from a breach like Diginotar's instantly; just remove their cert from your browser. You have no control over .COM's recovery from a breach.

tptacek 15y ago

You or I can point or click our way through dealing with a breach of a TLS certificate. Tell me what you'd personally do to deal with a rumored breach or misuse of .COM? Remember: under DNSSEC, Libya would have been BIT.LY's CA.

caf 15y ago
under DNSSEC, Libya would have been BIT.LY's CA. True, but at least it says that prominently on the tin.
- tptacek 15y ago
  I don't know you, so please don't take too much offense to this, but isn't that sentiment simply batshit crazy? "Sure, DNSSEC literally bakes an implicit trust in world governments into the core security model of the entire Internet, but at least it's up front about it!" Please understand this: you can stop trusting every HTTPS/SSL CA today, and, as you visit HTTPS sites, accept their keys individually. There is absolutely no reason whatsoever for anyone to settle on this point, either with negligent corporations or with governments.
  - caf 15y ago
    No, that was not my point. My point is the advantage here is that the name "BIT.LY" itself clearly says who you are trusting to certify that name: You are trusting ".LY". If you do not trust ".LY", you can go about your day ignoring "∗.LY" sites, and your ability to separately trust "∗.NO" is unaffected. The fact that governments ultimately control most of these trust domains is unfortunate, but it is still nice to be able to have different trust domains. If I want to actually see the unedited propaganda of the Libyan government, then I sure as hell do trust the Libyan government the most to deliver that; conversely, I trust the US Government the most to certify that I'm actually browsing whitehouse.gov. Such a model allows me to see when I am browsing the Libyan-government-guaranteed part of the Internet - I know that any lies I read are Libyan government lies, and if my pockets are fleeced they will be fleeced with Libyan government complicity or incompetence. And sure, it'd be great if governments didn't have a monopoly - if there was, say, a Google-guaranteed part of the Internet too. This isn't too crucial, though: ultimately, all corporations are answerable to at least one government, that can compel the corporation to act in the interest of that government. By trusting Verisign I'm already trusting the US Government - it's just hidden.
    - tptacek 15y ago
      Why should anybody's choice of names determine whether their users can trust SSL?
      - 15y ago
soult 15y ago
> Remember: under DNSSEC, Libya would have been BIT.LY's CA. Remember: With or without DNSSEC Libya sets falsified MX records for bit.ly, buys a certificate (without any hacking), because after all, a valid SSL certificate for domain.example means that someone verified that you indeed receive mail for webmaster@domain.example, and also suddenly has a certificate for Bit.ly. This has been critized by Kaminsky and other researchers for ages now. I know you love SSL. In fact, I like SSL too. But please stop advertising the CA system along with it, because it is horribly broken.
- tptacek 15y ago
  You and I agree about the CA system. SSL admits to things other than the CA system, like notary servers.