6 ms·

The CA system is fscked beyond repair (it always has been). We need an alternative now.

by Nux 14y ago

loungin 14y ago
Do you know of any alternatives being worked on? No snark intended, I am genuinely curious about the current state of affairs.
- casca 14y ago
  Check out http://tack.io/ http://tack.io/ and http://convergence.io/ http://convergence.io/ You could also listen to this if that's your preferred way of learning things: https://threatpost.com/en_us/blogs/moxie-marlinspike-tack-convergence-and-trust-agility-053012 https://threatpost.com/en_us/blogs/moxie-marlinspike-tack-co...
  - Nux 14y ago
    Last time Convergence was crapping out when using private (or otherwise unreachable) IPs - kind of makes sense, but still dissapointing. Will check out tack.io and CurveCP, cheers for the suggestions.
- paul_odin 14y ago
  There's DANE [1], which uses DNSSEC to authenticate TLS certificates. Chrome supports (or at least supported) something very similar but Chome-specific [2]. The code to support DANE in Chrome apparently exists but I don't know if it's actually available to use. [3] 1. http://datatracker.ietf.org/doc/rfc6698/ http://datatracker.ietf.org/doc/rfc6698/ 2. http://www.imperialviolet.org/2011/06/16/dnssecchrome.html http://www.imperialviolet.org/2011/06/16/dnssecchrome.html 3. http://www.imperialviolet.org/2012/10/20/dane-stapled-certificates.html http://www.imperialviolet.org/2012/10/20/dane-stapled-certif...
- __david__ 14y ago
  There's also CurveCP (http://curvecp.org/ http://curvecp.org/) which is a more radical alternative (replaces TCP and relies on DNSCurve, a DNS replacement) but has good security built in by default and some interesting features (remote users are identified by their public key so they can reconnect from different IP addresses and the stream keeps going without a reconnect). It seems like a much harder thing to get adoption going for but it has good thought behind it and can exist in parallel with the rest of the TCP/IP world. I would love to see it get to a place where you can just download it from Debian or Homebrew...
  - tquai 14y ago
    I've been using CurveCP for over a year privately and love it. I'll probably expand to production, starting with CurveHTTP, with the next release of NaCl. Not sure if that makes me the chicken or the egg.
- deleted 14y ago
  [deleted]
- jcase 14y ago
  Some developments in this area are: * Convergence.io * DNS-based Authentication of Named Entities (DANE) + DNSSEC * Tack.io For various reasons listed in [1] Convergence is not likely to be implemented (by default) in major browsers. On DANE + DNSSEC, where the cert is authenticated via the information published in your DNS, Moxie Marlinspike has said it better then I can: "CAs are sketchy, but this is a whole new world of sketchiness. Think, sketchasaurus. Registrars were never built or selected with security in mind, and most of them don’t have a very good track record in this area. Shouldn’t it be laughable that the current first step in deploying DNSSEC is to create an account with GoDaddy?"[2] The 2011 BlackHat video[3] and blog post[2] by Moxie Marlinspike are great sources of information. IMO, Tack.io is the most viable solution. It's compatible with the current model but removes the thread of one CA being able to compromise all domains. [1] http://www.imperialviolet.org/2011/09/07/convergence.html http://www.imperialviolet.org/2011/09/07/convergence.html [2] http://www.thoughtcrime.org/blog/ssl-and-the-future-of-authenticity/ http://www.thoughtcrime.org/blog/ssl-and-the-future-of-authe... [3] http://www.youtube.com/watch?v=Z7Wl2FW2TcA http://www.youtube.com/watch?v=Z7Wl2FW2TcA
  - richardwhiuk 14y ago
    Registrar's are trusted. They can change the DNS records for your domain to point at their servers, allowing them to intercept email. That's sufficient to allow them to get certificates issued for your domain through some providers.
    - jcase 14y ago
      For domain validated certs, certainly. The issue is that it doesn't solve anything. We merely shift (more) responsibility to registrars and NICs. You can change (untrust) registrars I suppose but if you have a .com you'll have to trust Verisign _forever_. Well, at least as long as they operate the .com tld. So if Verisign loses your trust, there is even less you can do than today.
- andrewcooke 14y ago
  no-one has mentioned perspectives (perhaps arguably because it's not an alternative, but a patch to help make the existing approach more reliable), but it exists now and seems to work - https://chrome.google.com/webstore/detail/perspectives/lnppfgdnjafeikakadfopejdpglpiahn?hl=en https://chrome.google.com/webstore/detail/perspectives/lnppf... https://addons.mozilla.org/en-us/firefox/addon/perspectives/ https://addons.mozilla.org/en-us/firefox/addon/perspectives/
mds_ 14y ago
Supporting http://tack.io/ http://tack.io/ is imo the most painless solution for what we have right now.
- mseebach 14y ago
  Judging by how Google says they stumbled over this, "Chrome detected and blocked an unauthorized digital certificate", it seems that's roughly what they're doing. I wonder how many sites it's able to do this for. (but yes, that is definitely a good solution)
  - danielweber 14y ago
    Chrome (the browser) is super-paranoid about other people replacing google.com certificates. It knows exactly what they should be and anything else is cause for alarm. 'tptacek talks about it from time to time.
  - jcase 14y ago
    Indeed. Chrome has baked-in public key pinning for their services. http://www.imperialviolet.org/2011/05/04/pinning.html http://www.imperialviolet.org/2011/05/04/pinning.html
  - schoen 14y ago
    You can see the pins list at https://src.chromium.org/viewvc/chrome/trunk/src/net/base/transport_security_state_static.h?view=markup https://src.chromium.org/viewvc/chrome/trunk/src/net/base/tr... Those are the sites that they're currently able to do it for. :-) If anyone reading wants to have your own site added to the HSTS preload (or perhaps cert pin) lists, I think the Chromium developers are interested in hearing from you. I know they'll add HSTS preloads for any site, but I don't know for sure whether there's a size or popularity threshold of some sort for a cert pin.
- danielweber 14y ago
  It looks like it's still in the development phase? I'd like to start recommending it to clients, and then testing it on client sites, but right now I can't. EDIT: Oh, apparently plug ins for nginx and apache are now available. Sweeeeet. EDIT: Although I'm a bit nervous about turning it on. Several weeks ago I couldn't get to one of my websites where I had turned on HSTS for about an hour from Chrome, and I got absolutely no feedback from Chrome about what the problem was.
rdl 14y ago
The best thing right now is cert pinning in Chrome. Unfortunately it's only in Chrome, and is a manual process on Google's part, so it really isn't applicable to a lot of people.
- rdl 14y ago
  Gah, I hate the edit timeout, I meant key pinning. (the key is actually what gets hashed and pinned, not the cert, since certs get reissued all the time for administrative reasons)
deleted 14y ago
[deleted]

The CA system is fscked beyond repair (it always has been). We need an alternative now.

by Nux 14y ago

The CA system is fscked beyond repair (it always has been). We need an alternative now.

Do you know of any alternatives being worked on? No snark intended, I am genuinely curious about the current state of affairs.

casca 14y ago
Check out http://tack.io/ http://tack.io/ and http://convergence.io/ http://convergence.io/ You could also listen to this if that's your preferred way of learning things: https://threatpost.com/en_us/blogs/moxie-marlinspike-tack-convergence-and-trust-agility-053012 https://threatpost.com/en_us/blogs/moxie-marlinspike-tack-co...
- Nux 14y ago
  Last time Convergence was crapping out when using private (or otherwise unreachable) IPs - kind of makes sense, but still dissapointing. Will check out tack.io and CurveCP, cheers for the suggestions.
paul_odin 14y ago
There's DANE [1], which uses DNSSEC to authenticate TLS certificates. Chrome supports (or at least supported) something very similar but Chome-specific [2]. The code to support DANE in Chrome apparently exists but I don't know if it's actually available to use. [3] 1. http://datatracker.ietf.org/doc/rfc6698/ http://datatracker.ietf.org/doc/rfc6698/ 2. http://www.imperialviolet.org/2011/06/16/dnssecchrome.html http://www.imperialviolet.org/2011/06/16/dnssecchrome.html 3. http://www.imperialviolet.org/2012/10/20/dane-stapled-certificates.html http://www.imperialviolet.org/2012/10/20/dane-stapled-certif...
__david__ 14y ago
There's also CurveCP (http://curvecp.org/ http://curvecp.org/) which is a more radical alternative (replaces TCP and relies on DNSCurve, a DNS replacement) but has good security built in by default and some interesting features (remote users are identified by their public key so they can reconnect from different IP addresses and the stream keeps going without a reconnect). It seems like a much harder thing to get adoption going for but it has good thought behind it and can exist in parallel with the rest of the TCP/IP world. I would love to see it get to a place where you can just download it from Debian or Homebrew...
- tquai 14y ago
  I've been using CurveCP for over a year privately and love it. I'll probably expand to production, starting with CurveHTTP, with the next release of NaCl. Not sure if that makes me the chicken or the egg.
deleted 14y ago
[deleted]
jcase 14y ago
Some developments in this area are: * Convergence.io * DNS-based Authentication of Named Entities (DANE) + DNSSEC * Tack.io For various reasons listed in [1] Convergence is not likely to be implemented (by default) in major browsers. On DANE + DNSSEC, where the cert is authenticated via the information published in your DNS, Moxie Marlinspike has said it better then I can: "CAs are sketchy, but this is a whole new world of sketchiness. Think, sketchasaurus. Registrars were never built or selected with security in mind, and most of them don’t have a very good track record in this area. Shouldn’t it be laughable that the current first step in deploying DNSSEC is to create an account with GoDaddy?"[2] The 2011 BlackHat video[3] and blog post[2] by Moxie Marlinspike are great sources of information. IMO, Tack.io is the most viable solution. It's compatible with the current model but removes the thread of one CA being able to compromise all domains. [1] http://www.imperialviolet.org/2011/09/07/convergence.html http://www.imperialviolet.org/2011/09/07/convergence.html [2] http://www.thoughtcrime.org/blog/ssl-and-the-future-of-authenticity/ http://www.thoughtcrime.org/blog/ssl-and-the-future-of-authe... [3] http://www.youtube.com/watch?v=Z7Wl2FW2TcA http://www.youtube.com/watch?v=Z7Wl2FW2TcA
- richardwhiuk 14y ago
  Registrar's are trusted. They can change the DNS records for your domain to point at their servers, allowing them to intercept email. That's sufficient to allow them to get certificates issued for your domain through some providers.
  - jcase 14y ago
    For domain validated certs, certainly. The issue is that it doesn't solve anything. We merely shift (more) responsibility to registrars and NICs. You can change (untrust) registrars I suppose but if you have a .com you'll have to trust Verisign _forever_. Well, at least as long as they operate the .com tld. So if Verisign loses your trust, there is even less you can do than today.
andrewcooke 14y ago
no-one has mentioned perspectives (perhaps arguably because it's not an alternative, but a patch to help make the existing approach more reliable), but it exists now and seems to work - https://chrome.google.com/webstore/detail/perspectives/lnppfgdnjafeikakadfopejdpglpiahn?hl=en https://chrome.google.com/webstore/detail/perspectives/lnppf... https://addons.mozilla.org/en-us/firefox/addon/perspectives/ https://addons.mozilla.org/en-us/firefox/addon/perspectives/

mds_ 14y ago

Supporting http://tack.io/ http://tack.io/ is imo the most painless solution for what we have right now.

mseebach 14y ago
Judging by how Google says they stumbled over this, "Chrome detected and blocked an unauthorized digital certificate", it seems that's roughly what they're doing. I wonder how many sites it's able to do this for. (but yes, that is definitely a good solution)
- danielweber 14y ago
  Chrome (the browser) is super-paranoid about other people replacing google.com certificates. It knows exactly what they should be and anything else is cause for alarm. 'tptacek talks about it from time to time.
- jcase 14y ago
  Indeed. Chrome has baked-in public key pinning for their services. http://www.imperialviolet.org/2011/05/04/pinning.html http://www.imperialviolet.org/2011/05/04/pinning.html
- schoen 14y ago
  You can see the pins list at https://src.chromium.org/viewvc/chrome/trunk/src/net/base/transport_security_state_static.h?view=markup https://src.chromium.org/viewvc/chrome/trunk/src/net/base/tr... Those are the sites that they're currently able to do it for. :-) If anyone reading wants to have your own site added to the HSTS preload (or perhaps cert pin) lists, I think the Chromium developers are interested in hearing from you. I know they'll add HSTS preloads for any site, but I don't know for sure whether there's a size or popularity threshold of some sort for a cert pin.
danielweber 14y ago
It looks like it's still in the development phase? I'd like to start recommending it to clients, and then testing it on client sites, but right now I can't. EDIT: Oh, apparently plug ins for nginx and apache are now available. Sweeeeet. EDIT: Although I'm a bit nervous about turning it on. Several weeks ago I couldn't get to one of my websites where I had turned on HSTS for about an hour from Chrome, and I got absolutely no feedback from Chrome about what the problem was.

rdl 14y ago

The best thing right now is cert pinning in Chrome. Unfortunately it's only in Chrome, and is a manual process on Google's part, so it really isn't applicable to a lot of people.

rdl 14y ago
Gah, I hate the edit timeout, I meant key pinning. (the key is actually what gets hashed and pinned, not the cert, since certs get reissued all the time for administrative reasons)

deleted 14y ago

[deleted]