6 ms·

Trevor Perrin and I have been working on a dynamic certificate pinning proposal called TACK to help mitigate these types of attacks: http://tack.io http://tack

• MichaelSalib 13y ago
  Your tack.io proposal looks great. Do you have any sense as to whether or when it will be adopted?
  • moxie 13y ago
    We have some large websites on board to deploy it, and Trevor has been working with browser vendors to get it integrated. The latter has been pretty slow going, but there is interest.
    • devx 13y ago
      Maybe browser vendors will take it more seriously now, and with more urgency.
      • randall 13y ago
        Especially one who's already had other services attacked. (Google)
    • StavrosK 13y ago
      This isn't a promise or official or anything, but I'm fairly sure that Silent Circle will be interested in deploying TACK. I can put it on the table, if you want, but anything that increases security will be welcome. Also, how does TACK relate to certificate pinning? The introduction has a few differences (e.g. tack expiration), but the two techniques seem pretty similar, am I missing something?
      • trevp 13y ago
        That would be great, we have a mailing list interested people should monitor, we'll definitely let people know once things get far enough for sites to start testing the waters. https://lists.riseup.net/www/arc/tack https://lists.riseup.net/www/arc/tack Regarding certificate pinning: TACK is a different "style" of pinning, it lets you pin to a self-managed signing key instead of certificate keys. So it gives you more control and security than CA pinning, if you're willing to assume more key management responsibilities (storing a TACK private key, and using it to sign new TLS keys). I think there's room for both approaches: I'd like to see CA pinning be made easy enough that most sites could deploy a fairly safe, simple pin to popular CAs, while high-security sites make use of TACK pins. But we'll see how things go.
        • StavrosK 13y ago
          Thanks, I will sign up to the list now. So, if I understand it correctly, TACK allows you to become your own CA. I will read the spec for more information (e.g. what prevents the MITM from becoming my CA?) but it sounds very interesting, thanks again.
          • trevp 13y ago
            Re "become your own CA" - that's basically the idea. The "pin activation" algorithm is intended to make it difficult for a MITM to foist bad pins on clients, and to limit the lifetime of such pins.
  • jackowayed 13y ago
    Faster the more help we get! As part of my Matasano internship, I've been working on a patch to NSS (Mozilla's crypto library, used by both Firefox and Chrome for TLS) that will give the necessary hooks needed for browsers that use NSS to implement TACK. I'll hopefully be submitting that for review soon (you can see it on bugzilla[1] and fresher in-progress GitHub[2]). At this point, it mostly makes sense for me to finish that (though I'll have a lot less time when I go back to school, so there might be some work that needs to get done when the review comments come back that I can't get to for awhile, so someone to power that to the finish might be helpful). But once that's in, we'll need to work on getting patches into the Firefox and Chrome that actually integrate TACK. There's also some other work to do, especially for some other longterm ideas we have (eg. securing communication between mail servers with TACK). If you're interested in helping, either email Trevor (email is on his website[3]), or email me (danielj@matasano for the next week, personal email in my profile). 1: https://bugzilla.mozilla.org/show_bug.cgi?id=905848 https://bugzilla.mozilla.org/show_bug.cgi?id=905848 2: https://github.com/jackowayed/mozilla-nss/pull/1 https://github.com/jackowayed/mozilla-nss/pull/1 3: http://trevp.net http://trevp.net
    • Create 13y ago
      "Before Netscape, Barksdale had worked as CEO of McCaw Cellular/AT&T Wireless and, before that, as Vice President and COO of FedEx. [...] President George W. Bush appointed him to the President's Foreign Intelligence Advisory Board." https://en.wikipedia.org/wiki/Jim_Barksdale https://en.wikipedia.org/wiki/Jim_Barksdale http://www.nytimes.com/2013/07/04/us/monitoring-of-snail-mail.html?pagewanted=all&_r=0 http://www.nytimes.com/2013/07/04/us/monitoring-of-snail-mai... http://www.mozilla.org/security/announce/2013/mfsa2013-53.html http://www.mozilla.org/security/announce/2013/mfsa2013-53.ht... http://www.wired.com/threatlevel/2013/09/freedom-hosting-fbi/ http://www.wired.com/threatlevel/2013/09/freedom-hosting-fbi... https://www.schneier.com/essay-448.html https://www.schneier.com/essay-448.html https://www.schneier.com/blog/archives/2013/06/blowback_from_t.html https://www.schneier.com/blog/archives/2013/06/blowback_from... "I generally do not connect to web sites from my own machine, aside from a few sites I have some special relationship with. I fetch web pages from other sites by sending mail to a program (see git://git.gnu.org/womb/hacks.git) that fetches them, much like wget, and then mails them back to me. Then I look at them using a web browser, unless it is easy to see the text in the HTML page directly. I usually try lynx first, then a graphical browser if the page needs it. I also browse from other people's computers, with their permission. Since I don't identify myself to the sites I visit, this browsing can't be connected with me. One consequence of this method is that most of the surveillance methods used on the Internet can't see me. Another consequence is that I never pay for anything on the Web. Anything on the net that requires payment, I don't do. I would not mind paying for a copy of an e-book or music recording on the Internet if I could do so anonymously, and it were ethical in other ways (no DRM or EULA). But that option almost never exists. I keep looking for ways to make it happen." http://stallman.org/stallman-computing.html http://stallman.org/stallman-computing.html
• einaros 13y ago
  While an absolute necessity, it doesn't solve the immediate issue of NSLs and widespread use of unnecessary services. Let's say that the NSA would like to track bitcoin transactions through MtGox. I don't know how easy it would be for them to plug a backdoor into a server in Japan, and let's assume that the NSA can't break the RC4 crypto their web server is configured to use .. Since MtGox uses Google Analytics, and possibly pull other scripts from Google's CDN, they could either eavesdrop on whatever data comes back from them by default -- or insist that changes are made to ... pick up more.
  • moxie 13y ago
    Yes, absolutely, there are more hurdles. As an extension of this pinning work, Trevor has also been working on a proposal for 3rd party includes that would allow you to specify a hashsum in the include line, as well as a proposal that would fix cookie scoping in backwards compatible way.
    • einaros 13y ago
      That would pretty much cover the use of CDNs that have proper versioning schemes. Analytics, however, will remain something I'm not overly fond of. For many sites it's unnecessary. For others it's something they could nearly just as easily license and deploy to their own servers. Pulling scripts in from Google Analytics, Statcounter and others -- and especially into privacy concerned apps -- is downright irresponsible. As I noted here: https://2x.io/read/would-the-nsa-infiltrate-cdns-to-circumvent-https https://2x.io/read/would-the-nsa-infiltrate-cdns-to-circumve..., even Norway's tax returns site (which hosts info I'd rather not have in any foreign company's hands) use external analytic scripts. They and 90% of the rest of the internet. No wonder the NSA claim they can circumvent most HTTPS encryption.
      • 001sky 13y ago
        even Norway's tax returns site...uses external analytic scripts. I'm curious who build that? Can they not count the filed docs.
• ck2 13y ago
  Does OCSP stapling help or hurt? How similar to TACK?
  • JshWright 13y ago
    It doesn't really impact the MiTM attacks described in the article. An attacker who is able to sit in the middle with their own trusted cert is simply going to not bother passing the stapled OCSP response along. The victims browser will do an OCSP lookup (or not...) for the trusted cert the attacker provided, and that will succeed. I'm not sure how OCSP caching is implemented in the browsers that implement OCSP in the first place (is there a spec for caching?), but as it's a method for checking the revocation status of certs, it can't be cached long.
    • ck2 13y ago
      I am not sure what it uses to validate but I have a ocsp stapling file I made openssl test reports OCSP Response Status: successful (0x0) Cert Status: good This Update: Sep 8 xx:xx:xx 2013 GMT Next Update: Sep 10 xx:xx:xx 2013 GMT Validity Not Before: Aug 22 xx:xx:xx 2013 GMT Not After : Oct 2 xx:xx:xx 2013 GMT So that's quite a long cache. I thought it would fail after the 10th but apparently it is using the CA valid date range?
• tptacek 13y ago
  A point worth making here: antisurveillance technology like TACK does more than make it harder for NSA to MITM TLS. As we've apparently discovered, it also makes it possible for us to detect TLS subversion. It is, right now, a major news story if someone has obtained a malicious root certificate; we need to know when that happens and to which CAs those certs chain (which is discoverable from the certificate). If you don't pay much attention to how TLS works, you should know that NSA (presumably) does not have a magic ability to inject new certs into your root cert repository. If you remove every CA cert from your browser and selectively allow certs, they can't MITM that. The CAs aren't baked into TLS! They're a software configuration detail. And when MITM certs appear on the wire, for them to be honored, they have to somehow chain to a specific CA. What things like pinning and TACK do is give us the opportunity to discover MITM certificates and start tracing them. If that capability becomes widespread enough, it can potentially foreclose on dragnet TLS MITM attacks, because there will be too much of a risk that deploying a dragnet MITM net will result in the death penalty for the implicated CA. TACK (and the related efforts) are hugely more important than I think most people think they are. If you want to advocate for something in the wake of the NSA debacle, I think TACK is a great choice.
  • rx4g 13y ago
    I have high hopes for TACK too. The fact that it's not CA dependent is a big deal. I wrote a bit about that, and getting by with ditching the root CAs in Firefox here: https://rx4g.com/2013/09/13/of-flying-pigs-and-tofu/ https://rx4g.com/2013/09/13/of-flying-pigs-and-tofu/ Unfortunately, ditching the root CAs is way harder than it should be, and flat out impossible in a lot of environments. Compulsory trust isn't trust.
  • belorn 13y ago
    You make a interesting point in describing TACK as intrusion detection system. It makes sense against larger adversaries, while the MITM protection make more sense against smaller. The question I have then is, what happen if look at TACK as an IDS. What is its false positive rate? Can it be lowered? Maybe it should inform the website owner as a way to inform both side of the communication that something eerie is happening.
• devx 13y ago
  Will you be able to make Convergence for Chrome, too (especially now with "packaged apps" and whatnot)?
• newman314 13y ago
  Moxie, have you had any success with getting TACK into OpenSSL builds with the various distributions? It's not a big deal to rebuild nginx/apache but I would think that getting TACK to ship default with OpenSSL would go a long way in getting more adoption.
  • trevp 13y ago
    We have support for a"ServerInfo" file checked into OpenSSL. This is a file with PEM blobs that can specify TACK and similar data (e.g. Certificate Transparency) that an OpenSSL server will return to clients if requested. This is a generic mechanism for TLS Extensions instead of TACK-specific, but it's what we need. It will hopefully appear in OpenSSL 1.0.2. We'll be submitting Apache patches for it shortly. Daniel Jackoway (in this thread somewhere) is working on the NSS (client-side) corollary.
    • newman314 13y ago
      Any chance this is backported to 0.9.8 series? I still see a ton of installs using 0.9.x
      • trevp 13y ago
        Don't think they do that with new features, but not totally sure.
• Margaret12 13y ago
  my buddy's mother-in-law makes $75 every hour on the internet. She has been without a job for seven months but last month her check was $17516 just working on the internet for a few hours. useful source... http://xurl.es/w2x2a http://xurl.es/w2x2a
• coldtea 13y ago
  >In the current state of the world, we're all dependent on CA signatures for each connection we make to a website. Now that you mentioned it, are those safe from say a government agency having access to the companies that serve as certificate authorities? Or is it all a house of cards, as it is now?
  • toyg 13y ago
    Some CAs make more of an effort to secure their crown jewels than others, but for the most part, it's a big house of cards. Which is why nothing serious happens to Comodo and Verisign when they get hacked: anybody knowledgeable is already aware that a certificate means very little on its own, and we can't stop the internet anyway, so hey, life goes on.
• unnuun 13y ago
  I'm _really_ glad that you're out there working on this problem. Is this any different than certpatrol? And also, what ended up happening to your convergence initiative? Finally, what do you recommend for individual folks to do in order to protect their SSL traffic? Thanks again for all the amazing work you do!
• huhtenberg 13y ago
  I've been running Firefox with CertPatrol add-on and if there's one take away is that simple client-side pinning generates so much noise that it conditions you into completely ignoring any certificate changes. Way, way too many websites either change their certs regularly or they use a CDN (and sometimes more than one) so that the page ends up getting a different cert on virtually every load. The most obvious example is Twitter's web interface - I am not a heavy user, but I still need to click through a dozen certificate changes per day. TACK is certainly a must-have and I'm really looking forward it being a native part of browsers, but there will still be likely a lot of (high-profile) websites that won't play along :-/ [0] http://patrol.psyced.org http://patrol.psyced.org
  • gojeks 13y ago
    the way to interpret this situation is to treat high-certificate-churn https sites as though they are plain http. the software UI should communicate "I give up, I can't trust this site anymore" and stop annoying you with attempts to manage the noise