5 ms·

> I would love to see a LetsEncrypt style service for OSS but I assume it's against the core interests of Microsoft / Apple to allow something like this as it w

by schoen 3y ago

> I would love to see a LetsEncrypt style service for OSS but I assume it's against the core interests of Microsoft / Apple to allow something like this as it would start to drive people away from the walled gardens of the app stores. People have been asking Let's Encrypt itself for this on the Let's Encrypt forum since the project was founded. The usual answer is that code signing certificates are (supposedly) trying to attest to a legal identity in the hope of being able to punish people offline if they publish malware, or allow people or organizations to have a policy about only installing software known to be from a certain list of publishers. DV certificates for HTTPS are trying to attest to control of a name in the DNS, which is verifiable by automated technical means, and which is not necessarily related to offline identity. (ICANN says it should be ... in an indirect way ... which isn't always complied with, and which, following increased pressure from European privacy law, is often not visible to the public.) A Let's Encrypt certificate would confirm that a certain key is apparently controlled by someone who apparently also controls a certain DNS name. But a code signing certificate would supposedly go further and confirm that it's apparently controlled by someone acting on behalf of a certain named legal person existing in a certain jurisdiction. This is much more expensive to verify usefully, although maybe some governments will eventually have a way to automate it. This isn't to say that either kind of certificate is necessarily ideal for all of the different uses to which relying parties end up putting it nowadays, but just that what they're attesting to, and how you would verify it, is pretty different. Edit: There seems to be a longer discussion about related points in this thread already at https://news.ycombinator.com/item?id=38056024 https://news.ycombinator.com/item?id=38056024

leosarev 3y ago
I think it would be fine to have code signing certificate ensures that signer controls a certain DNS name. I'm fine with "installer have been signed with somebody who owns imagemagick.org"
- 3c6bYDXLMj 3y ago
  Yes, but most people aren’t. It also significantly reduces the usefulness of code signing for the vast majority. And your justification for that is that it personally wouldn’t be a big deal to you, someone that has an abnormal understanding of the technologies at play.
  - AnthonyMouse 3y ago
    Why is it any less useful than some entity name? You can be pretty sure that google.com is controlled by Google, and if the domain on the app is g00gle.ru, that's going to fool exactly the same people as if the scammer's company name was Googel.
    - mike_hearn 3y ago
      Because domain names are cheap and can be purchased in bulk. TLS certificates are for encryption. You don't care if the endpoint is "bad" in some way, only that you are communicating with it securely. Code signing certificates are to make bans stick. Totally different purpose.
      - notpushkin 3y ago
        Companies aren't cheap, but they aren't exactly expensive either. A couple weeks ago I've registered a company in Estonia – it only cost me the 265 € state fee. Code signing certificate is another what, 500 euro on top of that? Certainly more expensive than a $10 domain with a free certificate, but still could be a reasonable cost for e. g. a targeted attack. There's another catch – you either have to register a company in your name, or find somebody to own it for you. I don't think the latter would be a big problem though: there was a lot of news about shady fintech startups in the Baltics lately and many of them were in fact registered in the name of random people looking for some quick cash. Now, if I see something like MicroSoft-Inc OÜ (EE) in the app signature, I would probably get a bit suspicious. But if it's a less known brand? Who knows!
        TeMPOraL 3y ago
        Sure, but once you start registering companies to run your shady schemes, you're in the process of transforming from a bad bad actor to a legitimate bad actor. Stop trying to steal bank credentials, and switch your spyware to pulling things that help to target ads, "optimize for engagement", or "streamline business", and suddenly the entire system starts working for you. You can then work in the clear, and use all the new security tools - like HSTS, DoH, certificate pinning, and code signing - to prevent your victims from protecting themselves from you.
- codedokode 3y ago
  Will you notice if the software will be signed by certificate for "imagemaqick.com" or "imagemagik.com" or "imagemagick-developers.com"?
  - londons_explore 3y ago
    Hopefully Windows will remember that I downloaded the file from imagemagic.com check that the certificate matches the place I downloaded it from... Although... As long as downloads are always provided from the official domain via HTTPS, and the OS can keep track of that, I don't really see why the executable itself needs to be signed...
    - tremon 3y ago
      imagemagick.org imagemagic.com That's a good way to illustrate the GP's point. As long as downloads are always provided from the official domain via HTTPS You are conflating control over the public website with control over the build/signing infrastructure. A good defense-in-depth strategy means that a compromise of one should not lead to an automatic compromise of the other.
    - yread 3y ago
      unless they use a cdn with a hostname like imagemagick-14.akamai.net
    - nolongerthere 3y ago
      Most OS software is downloaded from code repositories like github or fosshub to save on networking costs, not to mention CDNs that are often used even when the link is on the software's website the file itself will often not be "coming from" that website.
      - brnt 3y ago
        > Most OS software is downloaded from code repositories like github or fosshub to save on networking costs, [X] Doubt Do not underestimate the sheer number of people jamming in software names or descriptions into Google and getting their wares on the likes of softpedia.

by schoen 3y ago

leosarev 3y ago

I think it would be fine to have code signing certificate ensures that signer controls a certain DNS name. I'm fine with "installer have been signed with somebody who owns imagemagick.org"

3c6bYDXLMj 3y ago
Yes, but most people aren’t. It also significantly reduces the usefulness of code signing for the vast majority. And your justification for that is that it personally wouldn’t be a big deal to you, someone that has an abnormal understanding of the technologies at play.
- AnthonyMouse 3y ago
  Why is it any less useful than some entity name? You can be pretty sure that google.com is controlled by Google, and if the domain on the app is g00gle.ru, that's going to fool exactly the same people as if the scammer's company name was Googel.
  - mike_hearn 3y ago
    Because domain names are cheap and can be purchased in bulk. TLS certificates are for encryption. You don't care if the endpoint is "bad" in some way, only that you are communicating with it securely. Code signing certificates are to make bans stick. Totally different purpose.
    - notpushkin 3y ago
      Companies aren't cheap, but they aren't exactly expensive either. A couple weeks ago I've registered a company in Estonia – it only cost me the 265 € state fee. Code signing certificate is another what, 500 euro on top of that? Certainly more expensive than a $10 domain with a free certificate, but still could be a reasonable cost for e. g. a targeted attack. There's another catch – you either have to register a company in your name, or find somebody to own it for you. I don't think the latter would be a big problem though: there was a lot of news about shady fintech startups in the Baltics lately and many of them were in fact registered in the name of random people looking for some quick cash. Now, if I see something like MicroSoft-Inc OÜ (EE) in the app signature, I would probably get a bit suspicious. But if it's a less known brand? Who knows!
      - TeMPOraL 3y ago
        Sure, but once you start registering companies to run your shady schemes, you're in the process of transforming from a bad bad actor to a legitimate bad actor. Stop trying to steal bank credentials, and switch your spyware to pulling things that help to target ads, "optimize for engagement", or "streamline business", and suddenly the entire system starts working for you. You can then work in the clear, and use all the new security tools - like HSTS, DoH, certificate pinning, and code signing - to prevent your victims from protecting themselves from you.
codedokode 3y ago
Will you notice if the software will be signed by certificate for "imagemaqick.com" or "imagemagik.com" or "imagemagick-developers.com"?
- londons_explore 3y ago
  Hopefully Windows will remember that I downloaded the file from imagemagic.com check that the certificate matches the place I downloaded it from... Although... As long as downloads are always provided from the official domain via HTTPS, and the OS can keep track of that, I don't really see why the executable itself needs to be signed...
  - tremon 3y ago
    imagemagick.org imagemagic.com That's a good way to illustrate the GP's point. As long as downloads are always provided from the official domain via HTTPS You are conflating control over the public website with control over the build/signing infrastructure. A good defense-in-depth strategy means that a compromise of one should not lead to an automatic compromise of the other.
  - yread 3y ago
    unless they use a cdn with a hostname like imagemagick-14.akamai.net
  - nolongerthere 3y ago
    Most OS software is downloaded from code repositories like github or fosshub to save on networking costs, not to mention CDNs that are often used even when the link is on the software's website the file itself will often not be "coming from" that website.
    - brnt 3y ago
      > Most OS software is downloaded from code repositories like github or fosshub to save on networking costs, [X] Doubt Do not underestimate the sheer number of people jamming in software names or descriptions into Google and getting their wares on the likes of softpedia.