5 ms·

We definitely don't "just" trust the certificate authorities. Considerable effort is spent monitoring CAs for non-compliance, and CAs which are found untrustwo

by agwa 3y ago

We definitely don't "just" trust the certificate authorities. Considerable effort is spent monitoring CAs for non-compliance, and CAs which are found untrustworthy are booted.

matheusmoreira 3y ago
I'm not sure those efforts amount to anything, no matter how considerable. Some nation state can probably just scream national security and compromise the whole thing, complete with gag orders preventing people from blowing the whistle.
- agwa 3y ago
  Transparency is not optional - Chrome and Safari don't accept certificates that aren't published in Certificate Transparency logs. Certificate Transparency logs use Merkle Trees so that if they try to hide a certificate, it can be detected. The system is designed to resist subversion, even by governments. While there are scenarios where a sufficiently-powerful attacker could successfully subvert the system, they run a high risk of being detected if they try. It's just not as simple as you imply.
  - bavell 3y ago
    I'd love to see some good links/resources to read up on this area more. What are all the feedback mechanisms the CA ecosystem uses to resist subversion and bad actors?
  - matheusmoreira 3y ago
    I didn't know about certificate transparency. Thanks, I learned something today.
- vilunov 3y ago
  It already [almost] happened twice. Kazakhstan had plans to introduce country-wide MITM with certificates signed by a government agency, whose root certificate would have had to be marked as trusted if you wanted to use internet [1]. Many Russian government websites including the largest retail bank had their certificates revoked due to sanctions, which forced the government to start their own untrustworthy certificate center, whose root CA is trusted out of the box by Yandex Browser and has to be trusted if you wanted to access these sites [2]. [1]: https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-middle_attack https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-middle_a... [2]: (In Russian) https://www.gosuslugi.ru/tls https://www.gosuslugi.ru/tls

by agwa 3y ago

We definitely don't "just" trust the certificate authorities. Considerable effort is spent monitoring CAs for non-compliance, and CAs which are found untrustworthy are booted.

matheusmoreira 3y ago

I'm not sure those efforts amount to anything, no matter how considerable. Some nation state can probably just scream national security and compromise the whole thing, complete with gag orders preventing people from blowing the whistle.

agwa 3y ago
Transparency is not optional - Chrome and Safari don't accept certificates that aren't published in Certificate Transparency logs. Certificate Transparency logs use Merkle Trees so that if they try to hide a certificate, it can be detected. The system is designed to resist subversion, even by governments. While there are scenarios where a sufficiently-powerful attacker could successfully subvert the system, they run a high risk of being detected if they try. It's just not as simple as you imply.
- bavell 3y ago
  I'd love to see some good links/resources to read up on this area more. What are all the feedback mechanisms the CA ecosystem uses to resist subversion and bad actors?
- matheusmoreira 3y ago
  I didn't know about certificate transparency. Thanks, I learned something today.
vilunov 3y ago
It already [almost] happened twice. Kazakhstan had plans to introduce country-wide MITM with certificates signed by a government agency, whose root certificate would have had to be marked as trusted if you wanted to use internet [1]. Many Russian government websites including the largest retail bank had their certificates revoked due to sanctions, which forced the government to start their own untrustworthy certificate center, whose root CA is trusted out of the box by Yandex Browser and has to be trusted if you wanted to access these sites [2]. [1]: https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-middle_attack https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-middle_a... [2]: (In Russian) https://www.gosuslugi.ru/tls https://www.gosuslugi.ru/tls