20 ms·
Rant engaged. As a person who feels responsible for ensuring what I build is secure, the security space feels inscrutably defeating. Is there a dummies guide, M
by tomrod 5y ago
Rant engaged. As a person who feels responsible for ensuring what I build is secure, the security space feels inscrutably defeating. Is there a dummies guide, MOOC, cert, or other instructional material to better get a handle on all these things?
SSH keys make sense. But certificates? Is this OIDC, SAML, what? Is it unreasonable to request better and deeper "how to do {new security thing}" when PKI is a new acronym to someone? Where can I point my data science managers so they can understand the need and how to implement measures to have security on PII-laden dashboards? As so on.
- jpgvm 5y agoI would say PKI (and especially the associated X509 standards) is by far the least understood (or most misunderstood) part of actually building secure stuff. It would be nice if there was a dummies guide but I'm not really aware of one. Doesn't help that most of "how to PKI" on the web amounts to a bunch of unexplained cryptic openssl CLI incantations.
- dfox 5y agoIt is combination of two things. X.509 is arguably overly complex ASN.1/X.500 thing, but that is not the main issue. Main issue is that most people do not even grasp the concept of a certificate (ie. binding of public key to some additional information that is signed by some other entity).
- raxxorrax 5y agoAlso it is a moving space. Browsers don't accept a single certificate for a site anymore, you also have to have that signed by a CA. You can create such a certificate yourself too, but as of today you will need at least two certificates for browsers to fully accept a TLS secured connection. It hasn't been that long since that rule is in place. So it isn't only the technicalities of asynchronous encryption, there is also specific behavior of applications that use certificates to prove identities.
- brandonmenc 5y agoI recommend Security without Obscurity: A Guide to PKI Operations by W. Clay Epstein and Bulletproof TLS and PKI by Ivan Ristić. I started working in this space a year ago (I'm on a project deploying zero trust networking at a large company) and these books have been invaluable. https://www.amazon.com/gp/product/036765864X https://www.amazon.com/gp/product/036765864X https://www.feistyduck.com/books/bulletproof-tls-and-pki/ https://www.feistyduck.com/books/bulletproof-tls-and-pki/
- blueflow 5y agoI can surely recommend reading into SSH certificates using the ssh-keygen manpage. No any extra tools required. I sign SSH certificates for all my keypairs on my client devices, principal is set to my unix username, expiry is some weeks or months. The servers have my CA set via TrustedUserCAKeys in sshd_config (see manpages). SSH into root is forbidden per default, i SSH into an account with my principal name and then sudo or doas. My gain in all of this: I have n clients and m servers. Instead of having to maintain all keys for all clients on all servers, i now only need to maintain the certificate on each client individually. If i loose or forget a client, its certificate runs out and becomes invalidated.
- jas- 5y agoNow you have a centralized single point of failure. While the ease of use is inherently obvious with the implementation, if/when it does fail you will have to fall back to public key/password auth anyways.
- blueflow 5y agoWhich failure mode do you mean? The CA is accessible via offline means. I can walk to it and sign me a new keypair.
- jon-wood 5y agoWhat happens when the building the CA is in burns down?
- BenjiWiebe 5y agoScan printed QR codes of your private key that you had backed up off-site.
- tomrod 5y agoThat's actually pretty brilliant.
- michael_j_ward 5y agoI have the same feeling, and it motivated me to recently purchase this "Bulletproof TLS and PKI" [0] I haven't read it yet, so I'm posting i hope of someone else giving a quick review. https://www.feistyduck.com/books/bulletproof-tls-and-pki/ https://www.feistyduck.com/books/bulletproof-tls-and-pki/
- enriquto 5y ago> SSH keys make sense. But certificates? I am equally mystified... Never understood how involving a possibly malicious third party can make communication more trustworthy. But then again, I was also sure when I first heard about it that public key cryptography was obviously impossible. You just could not have secret communication when everything is on the open! Is there any simple explanation that we ignorant people can read about certificates to get an "aha! insight" moment? For the case of public key cryptography, the moment where everything snapped together was when I read the mathematical description of the Diffie-Helman key exchange [0]. I'm not interested in how to do certificates with ssh, but on what problem do certificates solve, exactly. [0] https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exc...
- dsr_ 5y agoA certificate is just a formatted list of attributes that has been signed by a particular private key. Username, UID, GID, membership in this, privilege for that, good-after date and good-until date, for instance. Everybody knows the public key associated with that private key, so you can verify that the private key did sign this list of attributes. An ssh keypair is an actual public/private keypair, but a certificate is just signed and encoded (but not encrypted) formatted data. If an ssh daemon has knowledge of a public key used to sign a cert, and has been instructed to trust that cert, and all the dates are good, then the ssh daemon can accept that cert as proof of identity and allow a login.
- enriquto 5y agoI understand what you mean, thanks for the explanation. But why would you want to do that? What problem does it solve? Just that you can connect without having a private key yourself? This doesn't sound very safe.
- tfigment 5y agoIt solves partly managing authorized_keys files. If you have a team separate keys can be difficult to manage. Shared keys are even worse. Certs can help with this if you properly manage the cert signing server (like hashicorp vault). All of that is currently free and open source. Also can now have short expiry times if desired.
- capn_duck 5y agoPractical Cryptography by Bruce Schneier and Niels Ferguson is decent in that it gives a good lay of the land without diving too deep in to the mathematical rigor. The first half explains at a high level the concepts of encryption, key exchange, asymmetric encryption, digital signatures, and lays out the problem statement that PKI solves. It's nice in that it will list out a bunch of available encryption algorithms or hash algorithms, but at the end of the chapter say "Just use this one, it's considered safe right now." i.e. AES256 and SHA256. Unfortunately, it mostly avoids the practical steps of web security, like its not going to print out the command to type in to your shell to generate an SSL signing certificate. So I wouldn't recommend it if you're looking for an immediately practical book to help you secure your web server. But it orients you to the landscape so you have a general idea of what you're trying to achieve, and can google yourself the rest of the way there.
- tomrod 5y agoI feel this is the exact right thing for me right now -- people trusted in industry. I can follow tutorials and documentation. The part where a concept is explained is often missing and can be guessed at (albeit often wrongly). I'll look into this and perhaps supplement with some good tutorials for my developers and data scientists. I appreciate your input!
- vngzs 5y agoIf they're willing to read a book on security design, I would recommend Security Engineering, 3rd Edition [0]. It includes a broad survey of what matters in the security space (rather than just cryptography), and generally in sufficient depth to understand how we may build secure platforms in the face of adversity. Also, many of the chapters are available to read for free - read author's text under the cover photo. [0]: https://www.cl.cam.ac.uk/~rja14/book.html https://www.cl.cam.ac.uk/~rja14/book.html
- tptacek 5y agoI don't think Practical Cryptography is going to give you much of an intuition about why this article is advocating for certificates.
- tener 5y agoI feel for you. Security is a complex, evolving topic, with a dizzying array of concepts. At work, we develop Teleport (https://goteleport.com/ https://goteleport.com/) to provide a secure access solution that is also easy to use and hard to get wrong. (Note: you cannot truly have "hard to use" and "secure" access, because people will always develop "backdoors" that are easier to use but not secure.) If you are interested in some accessible writing about security check out: https://goteleport.com/blog/ https://goteleport.com/blog/ On SAML: https://goteleport.com/blog/how-saml-authentication-works/ https://goteleport.com/blog/how-saml-authentication-works/ On OIDC: https://goteleport.com/blog/how-oidc-authentication-works/ https://goteleport.com/blog/how-oidc-authentication-works/ I can recommend the YouTube channel too: https://www.youtube.com/channel/UCmtTJaeEKYxCjfNGiijOyJw https://www.youtube.com/channel/UCmtTJaeEKYxCjfNGiijOyJw
- LambdaComplex 5y agoTeleport seems like a genuinely cool product. With that said, the company really needs to improve its interview process--my experience was downright terrible, and Glassdoor shows that other people had a similar experience
- GeorgeHahn 5y agoAs a current candidate, I'd be interested in hearing more about your interview experience.
- sparc24 5y agoTheir pricing is bat shit crazy. Stay far, far away.
- diarized 5y agoScalable and secure access with SSH @FB https://news.ycombinator.com/item?id=12482212 https://news.ycombinator.com/item?id=12482212
- hitpointdrew 5y agoCheck out teleport. It abstracts away the certificate bit and manages it for you. You run 'tsh login' once and you get a cert good for 12 hours (then you can get access to all the teleport resources you are allowed to, weather that is ssh server access, db access, kubernets access, etc.) I am evaluating the product now and am quite impressed. https://goteleport.com/ https://goteleport.com/
- throwaway984393 5y agoIt's not unreasonable, but we need some kind of universal knowledge base for tech stuff. Security is just one of many inscrutable topics in tech where you need weeks of research to understand the best practices.
- chefandy 5y agoMy needs may be entirely different than yours and I don't want to downplay the importance of security, but... Security writing in "engagement" obsessed media yields lots of people screaming "FIRE!" whenever seeing something even theoretically flammable, and bandwagoneers— already imagining their hair is on fire— lambasting everyone not immediately evacuating for being careless about fire safety. It reminds me of politicians being 'tough on crime'— they reflexively jump at opportunities to tighten the screws regardless of its necessity or efficacy. It's an emotional response involving self-image, peer pressure, and fashion rather than rational cost benefit analysis. Perfect is the enemy of good. Attacking every theoretical threat like an international bank's network admin yields no practical benefit for most. Not nobody but most. If this TLA is new to me, there will be another new one that people will lambast me for not knowing in a couple of years, max. For me, this problem was a better fit for the Wizard of Oz than a security education resource— what I really needed was the right frame of mind rather than learning the implementation details of every incremental certificate authority update. I evaluate my attack surfaces and reduce them if I can, evaluate the real importance of keeping what I'm protecting secret, implement standard precautions and architecture to mitigate those risks, pay attention to the systems, pay attention to new vulnerabilities, and re-evaluate upon changes. The process is technology-agnostic and only requires you deep dive into the stuff you need to know without feeling like you need a new certification ever 6 months to run your company's CalDAV server.
- scottLobster 5y agoRelevant article: How I learned to stop worrying (mostly) and love my threat model https://arstechnica.com/information-technology/2017/07/how-i-learned-to-stop-worrying-mostly-and-love-my-threat-model/ https://arstechnica.com/information-technology/2017/07/how-i...
- TedDoesntTalk 5y ago> evaluate the real importance of keeping what I'm protecting secret Excellent. This is often ignored by the security obsessed, those people yelling FIRE! as you say. Securing access to my cloud-hosted cat photos does not demand the same energy as securing ICBM launch codes.
- 5y ago
- pphysch 5y agoI spent an afternoon implementing a SSH cert service in Go using the standard "x/crypto/ssh" package, with little to no prior knowledge of SSH internals. SaaS like Smallstep and Teleport are trying to middleman and monetize what is actually a simple process that more developers should be comfortable implementing themselves. This isn't "rolling your own crypto", this is standard SSH key stuff plus a bit more nuance and LOC to make things more secure. When you pay for those services, you are essentially paying for a wrapped SSH command + dead-simple web app + someone to be your CA (read: store the resulting files of `ssh-keygen`, hopefully securely). And all the potential headaches of relying on yet another SaaS. Plenty of developers are comfortable writing a script, a simple web app, and securely storing a file on the webserver. This is all that is required to build SSH cert support into your internal apps/tools, plus an afternoon understanding how CAs work (in short, CA private key can sign any SSH public key, then that SSH public key can be validated by anyone holding the CA public key, no TOFU required).
- Aeolun 5y agoThis blog post seemed eminently understandable to me, at least as someone aware of public key, but not certificate based authentication.
- ozim 5y agoWhat is the scale you are operating on? If you are having 10-50 servers and 5-10 people working on those - SSH keys are definitely good enough, it might be a bit of hassle to manage keys but quite OK. If you go into large corporation area with more than 100 servers and more than 50 tech people that need to login to those servers you probably would already found out that there are other options and you probably have to run your internal CA (certificate authority). If your org grows you would probably have CTO and other technical people who will have experience knowledge to implement things differently.