4 ms·

Unverifiable security is not "strictly better" than plaintext.

bandrami 3y ago
It is. In both cases you may be MiTMed, but with plaintext that MiTM session may also be eavesdropped upon. This isn't really debateable. Unverified sig simply is strictly better.
- Avamander 3y ago
  In both cases you can be eavesdropped upon. It really isn't debatable indeed, unverifiable security is not security.
  - bandrami 3y ago
    Nope. An unverified TLS session still cannot be examined by a third party. You know you are communicating with exactly one party, even if you don't know who that is. Your attacker may share the data with a third party, but that's true of verified connections too.
    - Avamander 3y ago
      > even if you don't know who that is Thus it can be the eavesdropper, easy.
      - bandrami 3y ago
        Exactly, the eavesdropper. Even if you're being MiTMd by a criminal organization, you aren't also being listened to by the NSA.
    - woodruffw 3y ago
      "Private chat with the devil" is not a useful security model for most web sessions, and it's certainly not suitable for codesigning. Authenticity is the property we're aiming for; if it was just integrity, we'd do nothing at all other than provide digests.
      - bandrami 3y ago
        "Private chat with the devil" is the perfect security model for most web sessions. I trust very few websites I visit in any real sense.
        woodruffw 3y ago
        > "Private chat with the devil" is the perfect security model for most web sessions. I trust very few websites I visit in any real sense. I'm sorry, but this is either incorrect or a gross misunderstanding of your own threat model. Most people treat their online self as an extension of their physical self: that means banking information, private personal details, intimate communications, and everything else that's normally private by virtue of physical ownership needs to go through an authenticated channel. You might not care that someone can't MITM your Wikipedia traffic, but you almost certainly care that someone can't MITM your tax returns or your medical records.
        recursive 3y ago
        > You might not care that someone can't MITM your Wikipedia traffic, but you almost certainly care that someone can't MITM your tax returns or your medical records. So presumably, you'd demand a cert from a trustworthy authority in those cases. But you still don't want your ISP to be able to inject ads into the recipe blog you're reading.
        donaldstufft 3y ago
        With self signed certificates your ISP can just serve their own self signed certificate, and then inject ads into the recipe blog.
        bandrami 3y ago
        And I definitely want 3rd party verification for my tax preparation website. But I don't trust news.ycombinator.com any more than I trust somebody pretending to be news.ycombinator.com; validating that cert does nothing useful for me.
    - kuratkull 3y ago
      Unless you have the other parties selfsigned cert pinned, you very well may be experiencing MITM and not know about it.
      - bandrami 3y ago
        Exactly. You may be being MITMed, but that attack cannot also be eavesdropped or altered by another attacker.
        donaldstufft 3y ago
        Assuming of course that the other attacker doesn't just MITM the first attacker. But this is a very silly threat model, "I want exactly one person to be able to attack me at a time".
        bandrami 3y ago
        Not sure what's silly about that. If I'm on the hotel wifi I'd rather my neighbor not be able to eavesdrop on the person phishing me. I don't see what's so hard about this: Plaintext is worst (active and passive attacks possible) Unverified TLS is better (active attacks possible) Verified TLS is best (neither active nor passive attacks possible)
        sowbug 3y ago
        It's been a couple days since this thread quieted down, but I've continued to think about the logic behind the discussion. I believe the fallacy here is akin to arguing about numbers without units attached to them. For most of the people in this thread, the units are all something like "number of times my house burns down." I guess I'd rather my house burned down once rather than twice, so to that extent your position is not irrational. But the second time is not meaningfully different; the only further loss is maybe a magazine or newspaper that the postal service delivered the day after the first fire and placed on the ashes that used to be my mailbox. It's certainly sad that I won't get to read the paper after the second fire in as many days, but I'm still mostly concerned that my house burned down. Your units, on the other hand, are inconsistent and surprisingly ordered. Either you really enjoyed the unburned article you read, apparently enough to forget that the rest of your worldly possessions are gone (this is the "at least nobody eavesdropped on my conversation with the MITM" position), which implies that the units are large, or that avoidance of eavesdropping outweighs undetected MITM. Or else you wear an asbestos suit 24/7 because you already assumed most of the world is on fire and don't care if it engulfs your home (this is the part about how you believe HN could someday serve malicious JS, so that origin authenticity wasn't a big deal in the first place), which suggests that the units were small. Your values are your own, and only you can decide to change them. But the discussion might have been shorter and smoother if you'd acknowledged that others have been using a single, consistent unit called "catastrophes," and that the only numbers we care about are zero and any.
    - donaldstufft 3y ago
      It is true that an unverified TLS session does prevent passive attacks it does not prevent against "active" attacks. The general consensus is that it's not a useful property to differentiate passive from active here, since every passive attack can be upgraded to work as an active attack, on top of the fact that explaining the subtle differences to people is extremely difficult (and since they can be upgraded to active attacks, not worth it).

It is. In both cases you may be MiTMed, but with plaintext that MiTM session may also be eavesdropped upon. This isn't really debateable. Unverified sig simply is strictly better.

Avamander 3y ago
In both cases you can be eavesdropped upon. It really isn't debatable indeed, unverifiable security is not security.
- bandrami 3y ago
  Nope. An unverified TLS session still cannot be examined by a third party. You know you are communicating with exactly one party, even if you don't know who that is. Your attacker may share the data with a third party, but that's true of verified connections too.
  - Avamander 3y ago
    > even if you don't know who that is Thus it can be the eavesdropper, easy.
    - bandrami 3y ago
      Exactly, the eavesdropper. Even if you're being MiTMd by a criminal organization, you aren't also being listened to by the NSA.
  - woodruffw 3y ago
    "Private chat with the devil" is not a useful security model for most web sessions, and it's certainly not suitable for codesigning. Authenticity is the property we're aiming for; if it was just integrity, we'd do nothing at all other than provide digests.
    - bandrami 3y ago
      "Private chat with the devil" is the perfect security model for most web sessions. I trust very few websites I visit in any real sense.
      - woodruffw 3y ago
        > "Private chat with the devil" is the perfect security model for most web sessions. I trust very few websites I visit in any real sense. I'm sorry, but this is either incorrect or a gross misunderstanding of your own threat model. Most people treat their online self as an extension of their physical self: that means banking information, private personal details, intimate communications, and everything else that's normally private by virtue of physical ownership needs to go through an authenticated channel. You might not care that someone can't MITM your Wikipedia traffic, but you almost certainly care that someone can't MITM your tax returns or your medical records.
        recursive 3y ago
        > You might not care that someone can't MITM your Wikipedia traffic, but you almost certainly care that someone can't MITM your tax returns or your medical records. So presumably, you'd demand a cert from a trustworthy authority in those cases. But you still don't want your ISP to be able to inject ads into the recipe blog you're reading.
        donaldstufft 3y ago
        With self signed certificates your ISP can just serve their own self signed certificate, and then inject ads into the recipe blog.
        bandrami 3y ago
        And I definitely want 3rd party verification for my tax preparation website. But I don't trust news.ycombinator.com any more than I trust somebody pretending to be news.ycombinator.com; validating that cert does nothing useful for me.
  - kuratkull 3y ago
    Unless you have the other parties selfsigned cert pinned, you very well may be experiencing MITM and not know about it.
    - bandrami 3y ago
      Exactly. You may be being MITMed, but that attack cannot also be eavesdropped or altered by another attacker.
      - donaldstufft 3y ago
        Assuming of course that the other attacker doesn't just MITM the first attacker. But this is a very silly threat model, "I want exactly one person to be able to attack me at a time".
        bandrami 3y ago
        Not sure what's silly about that. If I'm on the hotel wifi I'd rather my neighbor not be able to eavesdrop on the person phishing me. I don't see what's so hard about this: Plaintext is worst (active and passive attacks possible) Unverified TLS is better (active attacks possible) Verified TLS is best (neither active nor passive attacks possible)
        sowbug 3y ago
        It's been a couple days since this thread quieted down, but I've continued to think about the logic behind the discussion. I believe the fallacy here is akin to arguing about numbers without units attached to them. For most of the people in this thread, the units are all something like "number of times my house burns down." I guess I'd rather my house burned down once rather than twice, so to that extent your position is not irrational. But the second time is not meaningfully different; the only further loss is maybe a magazine or newspaper that the postal service delivered the day after the first fire and placed on the ashes that used to be my mailbox. It's certainly sad that I won't get to read the paper after the second fire in as many days, but I'm still mostly concerned that my house burned down. Your units, on the other hand, are inconsistent and surprisingly ordered. Either you really enjoyed the unburned article you read, apparently enough to forget that the rest of your worldly possessions are gone (this is the "at least nobody eavesdropped on my conversation with the MITM" position), which implies that the units are large, or that avoidance of eavesdropping outweighs undetected MITM. Or else you wear an asbestos suit 24/7 because you already assumed most of the world is on fire and don't care if it engulfs your home (this is the part about how you believe HN could someday serve malicious JS, so that origin authenticity wasn't a big deal in the first place), which suggests that the units were small. Your values are your own, and only you can decide to change them. But the discussion might have been shorter and smoother if you'd acknowledged that others have been using a single, consistent unit called "catastrophes," and that the only numbers we care about are zero and any.
  - donaldstufft 3y ago
    It is true that an unverified TLS session does prevent passive attacks it does not prevent against "active" attacks. The general consensus is that it's not a useful property to differentiate passive from active here, since every passive attack can be upgraded to work as an active attack, on top of the fact that explaining the subtle differences to people is extremely difficult (and since they can be upgraded to active attacks, not worth it).