4 ms·

Unfortunately TLS is already conflating two problems as it is: 1. Is the opposite party who they claim to be? 2. Did a third party alter or eavesdrop on the tra

Unfortunately TLS is already conflating two problems as it is: 1. Is the opposite party who they claim to be? 2. Did a third party alter or eavesdrop on the transmission? That is, am I simply being phished in private or is the government also listening to me being phished? It's trivially easy to solve the second problem and it doesn't require any PKI infrastructure whatsoever and we delayed secure transport by decades by tying it to the generally less-useful question in #1. There are few entities online I trust more than I would trust someone impersonating them: basically only if money is changing hands. But I don't need to know that e.g. ycombinator.com is actually ycombinator.com because I don't trust ycmonbinator.com any more than I would trust someone impersonating ycombinator.com.

jcranmer 4y ago
It is not trivially easy to solve the second problem without solving the first problem. If you don't have proof of identity, all someone has to do to eavesdrop on you is pretend to be the person you're communicating with while actually communicating with them on your behalf.
- cesarb 4y ago
  It's the difference between a passive attack and an active attack. Most people think only of passive eavesdroppers, and against them it could be true that "it's trivially easy to solve the second problem and it doesn't require any PKI infrastructure whatsoever". But against an active attacker, unless you can solve the "is the opposite party who they claim to be" problem, it's trivially easy to eavesdrop by pretending to be the other party (MITM attack). And then you find out there are ways to convert a passive eavesdropper into an active attacker (remotely injecting packets to manipulate the TCP connection state, based on observed sequence numbers), and the distinction becomes a bit fuzzy...
- judge2020 4y ago
  It's trivially easy when that 'proof of identity' is purely a unique identifier shown to the user, and not actually tied to real-world identity. This is what a domain name is, ICANN ensures people can't register a domain name if someone already owns it, so with that guarantee, everyone trusts that 'google.com' showing up in their URL bar means that the certificate presented by the server they're connecting to is actually authorized to show 'google.com'.
  - jcranmer 4y ago
    That proof of identity still needs to solve the first problem... you still need to somehow prove that someone who says they're google.com is actually google.com.
    - salawat 4y ago
      That's part of why the Root CA certs are A) Long lived and B) why having an untrustworthy root CA is the most calamitous outcome possible. Because the algorithm that yields the answer to your question really only answers the question "Does the cert I was handed cryptographically validate back to a trusted root?" If you can pwn the routing/DNS sufficiently around an AS, you could MITM all the authoritative sources, and with something like TrustCor, willing to issue duplicitous root certs and cert chains, while being trusted by major OS and software package maintainers, you can, in theory, pull the old switcheroo, and the software will still tell you "seems legit, hoss". This is part of why the Internet is architected as a "collective network of networks composed of Trusted Agents". At the end of the day, you're depending on every middle box routing your packet to do the job to get it where it needs to go. The type of Trust you're looking for is incompatible with technologically facilitated networking in a sense. The network cannot prove the trustworthyness of the network. Trust has to start outside it. The trust we've rooted from is from the integrity of the institutions we've established. Something that has been eroded more and more over time as the Internet infrastructure has slowly been civically infiltrated to shape it into a surveillance tool by governments. If you're feeling heartburn over this, the problem isn't the Internet per se. It's your Government, and your institutions, and for places that like to think they are populace driven, the people around you.
    - judge2020 4y ago
      But you don't need to prove that. 1. registering google.com requires it being available, and their registry and registrars prohibit registering already-registered domains 2. these registries contain the authoritative DNS records for google.com 3. when anyone wants to pull a certificate for `www.google.com`, they first need to create a DNS TXT entry called "acme-challenge.google.com" (for example) Because of this, you know that whoever 'says' they're Google.com actually is Google.com because of how domain names work and because you see the lock icon in your browser. It's all built on trust of registries and registrars operating diligently, and it's checked by pretty much every big company watching for changes to their domains in case of malicious actions.
- bandrami 4y ago
  No. A PKI-less system can ensure I am communicating with one and only one party. That's all most comms need. If I want some assurance that party is who they claim to be that can be negotiated over that channel.

jcranmer 4y ago

It is not trivially easy to solve the second problem without solving the first problem. If you don't have proof of identity, all someone has to do to eavesdrop on you is pretend to be the person you're communicating with while actually communicating with them on your behalf.

cesarb 4y ago
It's the difference between a passive attack and an active attack. Most people think only of passive eavesdroppers, and against them it could be true that "it's trivially easy to solve the second problem and it doesn't require any PKI infrastructure whatsoever". But against an active attacker, unless you can solve the "is the opposite party who they claim to be" problem, it's trivially easy to eavesdrop by pretending to be the other party (MITM attack). And then you find out there are ways to convert a passive eavesdropper into an active attacker (remotely injecting packets to manipulate the TCP connection state, based on observed sequence numbers), and the distinction becomes a bit fuzzy...
judge2020 4y ago
It's trivially easy when that 'proof of identity' is purely a unique identifier shown to the user, and not actually tied to real-world identity. This is what a domain name is, ICANN ensures people can't register a domain name if someone already owns it, so with that guarantee, everyone trusts that 'google.com' showing up in their URL bar means that the certificate presented by the server they're connecting to is actually authorized to show 'google.com'.
- jcranmer 4y ago
  That proof of identity still needs to solve the first problem... you still need to somehow prove that someone who says they're google.com is actually google.com.
  - salawat 4y ago
    That's part of why the Root CA certs are A) Long lived and B) why having an untrustworthy root CA is the most calamitous outcome possible. Because the algorithm that yields the answer to your question really only answers the question "Does the cert I was handed cryptographically validate back to a trusted root?" If you can pwn the routing/DNS sufficiently around an AS, you could MITM all the authoritative sources, and with something like TrustCor, willing to issue duplicitous root certs and cert chains, while being trusted by major OS and software package maintainers, you can, in theory, pull the old switcheroo, and the software will still tell you "seems legit, hoss". This is part of why the Internet is architected as a "collective network of networks composed of Trusted Agents". At the end of the day, you're depending on every middle box routing your packet to do the job to get it where it needs to go. The type of Trust you're looking for is incompatible with technologically facilitated networking in a sense. The network cannot prove the trustworthyness of the network. Trust has to start outside it. The trust we've rooted from is from the integrity of the institutions we've established. Something that has been eroded more and more over time as the Internet infrastructure has slowly been civically infiltrated to shape it into a surveillance tool by governments. If you're feeling heartburn over this, the problem isn't the Internet per se. It's your Government, and your institutions, and for places that like to think they are populace driven, the people around you.
  - judge2020 4y ago
    But you don't need to prove that. 1. registering google.com requires it being available, and their registry and registrars prohibit registering already-registered domains 2. these registries contain the authoritative DNS records for google.com 3. when anyone wants to pull a certificate for `www.google.com`, they first need to create a DNS TXT entry called "acme-challenge.google.com" (for example) Because of this, you know that whoever 'says' they're Google.com actually is Google.com because of how domain names work and because you see the lock icon in your browser. It's all built on trust of registries and registrars operating diligently, and it's checked by pretty much every big company watching for changes to their domains in case of malicious actions.
bandrami 4y ago
No. A PKI-less system can ensure I am communicating with one and only one party. That's all most comms need. If I want some assurance that party is who they claim to be that can be negotiated over that channel.