4 ms·

Honestly, email would do the job too, if it was signed email. I’m pretty sure the largest deployed PKI system is the US federal government’s - it really feels

Honestly, email would do the job too, if it was signed email. I’m pretty sure the largest deployed PKI system is the US federal government’s - it really feels like we should be able to deploy something for law enforcement agencies. (And in fact that’s what the legislation mentioned at the end of the article appears to do.)

giantg2 5y ago
Does that actually fix the issue if they've compromised the security of the email server using real or generated accounts?
- ryukafalz 5y ago
  The email server typically does not contain key material. If you’ve ever interacted with the military or related contractors you may recognize this card: https://www.cac.mil/common-access-card/ https://www.cac.mil/common-access-card/ That’s a smart card, containing a certificate that can be used to sign email, be used as a client cert for web access, etc. Now, it has moved the problem to some extent, in that now you have to secure the CA that’s issuing these certs.
  - giantg2 5y ago
    I'm a little familiar with CAC cards from years ago. I don't believe they were using them to sign emails at that time. Thats different than the signing process I was familiar with. That would work.
  - nonameiguess 5y ago
    The DoD root CAs are pretty damn secure. They're offline in physical vaults on military installations. Compromising one of those is a far cry more difficult than some town of 400's local PD e-mail server. Granted, you only need to compromise a RAPIDs office to issue yourself a CAC, but that is still offline and on military installations (though often much less secure reserve/guard installations).
    - giantg2 5y ago
      Wouldn't the cert need to be specific to the individual for proper identification? So getting one for yourself might not provide the sufficient privilege.
      - chipsa 5y ago
        The cert would verify that a specific individual signed the email, with someone having previously verified issuing the credential to the right person (this sort of thing is usually issued as a smart card ID, so it's used for several things, and it's unlikely people lose it without reporting it lost and getting it revoked).
        giantg2 5y ago
        They specifically mentioned issuing themself one, not stealing one.
        chipsa 5y ago
        Yeah, issuing themself one through RAPIDS. You need to authenticate against RAPIDS to issue one. So you're looking at stealing a credential, and hoping you can get it done before it's noticed it's gone and revoked, and hoping that they don't go ahead and look at logins between when it was last seen and when it was revoked in order to see if there's any weirdness, at which point your credential gets revoked. If they did something similar for law enforcement, it would probably have the same sort of restrictions: you need to authenticate to get a credential, but to authenticate you need a credential. So you need to steal one to issue yourself one.

giantg2 5y ago

Does that actually fix the issue if they've compromised the security of the email server using real or generated accounts?

ryukafalz 5y ago
The email server typically does not contain key material. If you’ve ever interacted with the military or related contractors you may recognize this card: https://www.cac.mil/common-access-card/ https://www.cac.mil/common-access-card/ That’s a smart card, containing a certificate that can be used to sign email, be used as a client cert for web access, etc. Now, it has moved the problem to some extent, in that now you have to secure the CA that’s issuing these certs.
- giantg2 5y ago
  I'm a little familiar with CAC cards from years ago. I don't believe they were using them to sign emails at that time. Thats different than the signing process I was familiar with. That would work.
- nonameiguess 5y ago
  The DoD root CAs are pretty damn secure. They're offline in physical vaults on military installations. Compromising one of those is a far cry more difficult than some town of 400's local PD e-mail server. Granted, you only need to compromise a RAPIDs office to issue yourself a CAC, but that is still offline and on military installations (though often much less secure reserve/guard installations).
  - giantg2 5y ago
    Wouldn't the cert need to be specific to the individual for proper identification? So getting one for yourself might not provide the sufficient privilege.
    - chipsa 5y ago
      The cert would verify that a specific individual signed the email, with someone having previously verified issuing the credential to the right person (this sort of thing is usually issued as a smart card ID, so it's used for several things, and it's unlikely people lose it without reporting it lost and getting it revoked).
      - giantg2 5y ago
        They specifically mentioned issuing themself one, not stealing one.
        chipsa 5y ago
        Yeah, issuing themself one through RAPIDS. You need to authenticate against RAPIDS to issue one. So you're looking at stealing a credential, and hoping you can get it done before it's noticed it's gone and revoked, and hoping that they don't go ahead and look at logins between when it was last seen and when it was revoked in order to see if there's any weirdness, at which point your credential gets revoked. If they did something similar for law enforcement, it would probably have the same sort of restrictions: you need to authenticate to get a credential, but to authenticate you need a credential. So you need to steal one to issue yourself one.