4 ms·

Your tack.io proposal looks great. Do you have any sense as to whether or when it will be adopted?

moxie 13y ago
We have some large websites on board to deploy it, and Trevor has been working with browser vendors to get it integrated. The latter has been pretty slow going, but there is interest.
- devx 13y ago
  Maybe browser vendors will take it more seriously now, and with more urgency.
  - randall 13y ago
    Especially one who's already had other services attacked. (Google)
- StavrosK 13y ago
  This isn't a promise or official or anything, but I'm fairly sure that Silent Circle will be interested in deploying TACK. I can put it on the table, if you want, but anything that increases security will be welcome. Also, how does TACK relate to certificate pinning? The introduction has a few differences (e.g. tack expiration), but the two techniques seem pretty similar, am I missing something?
  - trevp 13y ago
    That would be great, we have a mailing list interested people should monitor, we'll definitely let people know once things get far enough for sites to start testing the waters. https://lists.riseup.net/www/arc/tack https://lists.riseup.net/www/arc/tack Regarding certificate pinning: TACK is a different "style" of pinning, it lets you pin to a self-managed signing key instead of certificate keys. So it gives you more control and security than CA pinning, if you're willing to assume more key management responsibilities (storing a TACK private key, and using it to sign new TLS keys). I think there's room for both approaches: I'd like to see CA pinning be made easy enough that most sites could deploy a fairly safe, simple pin to popular CAs, while high-security sites make use of TACK pins. But we'll see how things go.
    - StavrosK 13y ago
      Thanks, I will sign up to the list now. So, if I understand it correctly, TACK allows you to become your own CA. I will read the spec for more information (e.g. what prevents the MITM from becoming my CA?) but it sounds very interesting, thanks again.
      - trevp 13y ago
        Re "become your own CA" - that's basically the idea. The "pin activation" algorithm is intended to make it difficult for a MITM to foist bad pins on clients, and to limit the lifetime of such pins.
jackowayed 13y ago
Faster the more help we get! As part of my Matasano internship, I've been working on a patch to NSS (Mozilla's crypto library, used by both Firefox and Chrome for TLS) that will give the necessary hooks needed for browsers that use NSS to implement TACK. I'll hopefully be submitting that for review soon (you can see it on bugzilla[1] and fresher in-progress GitHub[2]). At this point, it mostly makes sense for me to finish that (though I'll have a lot less time when I go back to school, so there might be some work that needs to get done when the review comments come back that I can't get to for awhile, so someone to power that to the finish might be helpful). But once that's in, we'll need to work on getting patches into the Firefox and Chrome that actually integrate TACK. There's also some other work to do, especially for some other longterm ideas we have (eg. securing communication between mail servers with TACK). If you're interested in helping, either email Trevor (email is on his website[3]), or email me (danielj@matasano for the next week, personal email in my profile). 1: https://bugzilla.mozilla.org/show_bug.cgi?id=905848 https://bugzilla.mozilla.org/show_bug.cgi?id=905848 2: https://github.com/jackowayed/mozilla-nss/pull/1 https://github.com/jackowayed/mozilla-nss/pull/1 3: http://trevp.net http://trevp.net
- Create 13y ago
  "Before Netscape, Barksdale had worked as CEO of McCaw Cellular/AT&T Wireless and, before that, as Vice President and COO of FedEx. [...] President George W. Bush appointed him to the President's Foreign Intelligence Advisory Board." https://en.wikipedia.org/wiki/Jim_Barksdale https://en.wikipedia.org/wiki/Jim_Barksdale http://www.nytimes.com/2013/07/04/us/monitoring-of-snail-mail.html?pagewanted=all&_r=0 http://www.nytimes.com/2013/07/04/us/monitoring-of-snail-mai... http://www.mozilla.org/security/announce/2013/mfsa2013-53.html http://www.mozilla.org/security/announce/2013/mfsa2013-53.ht... http://www.wired.com/threatlevel/2013/09/freedom-hosting-fbi/ http://www.wired.com/threatlevel/2013/09/freedom-hosting-fbi... https://www.schneier.com/essay-448.html https://www.schneier.com/essay-448.html https://www.schneier.com/blog/archives/2013/06/blowback_from_t.html https://www.schneier.com/blog/archives/2013/06/blowback_from... "I generally do not connect to web sites from my own machine, aside from a few sites I have some special relationship with. I fetch web pages from other sites by sending mail to a program (see git://git.gnu.org/womb/hacks.git) that fetches them, much like wget, and then mails them back to me. Then I look at them using a web browser, unless it is easy to see the text in the HTML page directly. I usually try lynx first, then a graphical browser if the page needs it. I also browse from other people's computers, with their permission. Since I don't identify myself to the sites I visit, this browsing can't be connected with me. One consequence of this method is that most of the surveillance methods used on the Internet can't see me. Another consequence is that I never pay for anything on the Web. Anything on the net that requires payment, I don't do. I would not mind paying for a copy of an e-book or music recording on the Internet if I could do so anonymously, and it were ethical in other ways (no DRM or EULA). But that option almost never exists. I keep looking for ways to make it happen." http://stallman.org/stallman-computing.html http://stallman.org/stallman-computing.html

moxie 13y ago

We have some large websites on board to deploy it, and Trevor has been working with browser vendors to get it integrated. The latter has been pretty slow going, but there is interest.

devx 13y ago
Maybe browser vendors will take it more seriously now, and with more urgency.
- randall 13y ago
  Especially one who's already had other services attacked. (Google)
StavrosK 13y ago
This isn't a promise or official or anything, but I'm fairly sure that Silent Circle will be interested in deploying TACK. I can put it on the table, if you want, but anything that increases security will be welcome. Also, how does TACK relate to certificate pinning? The introduction has a few differences (e.g. tack expiration), but the two techniques seem pretty similar, am I missing something?
- trevp 13y ago
  That would be great, we have a mailing list interested people should monitor, we'll definitely let people know once things get far enough for sites to start testing the waters. https://lists.riseup.net/www/arc/tack https://lists.riseup.net/www/arc/tack Regarding certificate pinning: TACK is a different "style" of pinning, it lets you pin to a self-managed signing key instead of certificate keys. So it gives you more control and security than CA pinning, if you're willing to assume more key management responsibilities (storing a TACK private key, and using it to sign new TLS keys). I think there's room for both approaches: I'd like to see CA pinning be made easy enough that most sites could deploy a fairly safe, simple pin to popular CAs, while high-security sites make use of TACK pins. But we'll see how things go.
  - StavrosK 13y ago
    Thanks, I will sign up to the list now. So, if I understand it correctly, TACK allows you to become your own CA. I will read the spec for more information (e.g. what prevents the MITM from becoming my CA?) but it sounds very interesting, thanks again.
    - trevp 13y ago
      Re "become your own CA" - that's basically the idea. The "pin activation" algorithm is intended to make it difficult for a MITM to foist bad pins on clients, and to limit the lifetime of such pins.

jackowayed 13y ago

Faster the more help we get! As part of my Matasano internship, I've been working on a patch to NSS (Mozilla's crypto library, used by both Firefox and Chrome for TLS) that will give the necessary hooks needed for browsers that use NSS to implement TACK. I'll hopefully be submitting that for review soon (you can see it on bugzilla[1] and fresher in-progress GitHub[2]). At this point, it mostly makes sense for me to finish that (though I'll have a lot less time when I go back to school, so there might be some work that needs to get done when the review comments come back that I can't get to for awhile, so someone to power that to the finish might be helpful). But once that's in, we'll need to work on getting patches into the Firefox and Chrome that actually integrate TACK. There's also some other work to do, especially for some other longterm ideas we have (eg. securing communication between mail servers with TACK). If you're interested in helping, either email Trevor (email is on his website[3]), or email me (danielj@matasano for the next week, personal email in my profile). 1: https://bugzilla.mozilla.org/show_bug.cgi?id=905848 https://bugzilla.mozilla.org/show_bug.cgi?id=905848 2: https://github.com/jackowayed/mozilla-nss/pull/1 https://github.com/jackowayed/mozilla-nss/pull/1 3: http://trevp.net http://trevp.net

Create 13y ago
"Before Netscape, Barksdale had worked as CEO of McCaw Cellular/AT&T Wireless and, before that, as Vice President and COO of FedEx. [...] President George W. Bush appointed him to the President's Foreign Intelligence Advisory Board." https://en.wikipedia.org/wiki/Jim_Barksdale https://en.wikipedia.org/wiki/Jim_Barksdale http://www.nytimes.com/2013/07/04/us/monitoring-of-snail-mail.html?pagewanted=all&_r=0 http://www.nytimes.com/2013/07/04/us/monitoring-of-snail-mai... http://www.mozilla.org/security/announce/2013/mfsa2013-53.html http://www.mozilla.org/security/announce/2013/mfsa2013-53.ht... http://www.wired.com/threatlevel/2013/09/freedom-hosting-fbi/ http://www.wired.com/threatlevel/2013/09/freedom-hosting-fbi... https://www.schneier.com/essay-448.html https://www.schneier.com/essay-448.html https://www.schneier.com/blog/archives/2013/06/blowback_from_t.html https://www.schneier.com/blog/archives/2013/06/blowback_from... "I generally do not connect to web sites from my own machine, aside from a few sites I have some special relationship with. I fetch web pages from other sites by sending mail to a program (see git://git.gnu.org/womb/hacks.git) that fetches them, much like wget, and then mails them back to me. Then I look at them using a web browser, unless it is easy to see the text in the HTML page directly. I usually try lynx first, then a graphical browser if the page needs it. I also browse from other people's computers, with their permission. Since I don't identify myself to the sites I visit, this browsing can't be connected with me. One consequence of this method is that most of the surveillance methods used on the Internet can't see me. Another consequence is that I never pay for anything on the Web. Anything on the net that requires payment, I don't do. I would not mind paying for a copy of an e-book or music recording on the Internet if I could do so anonymously, and it were ethical in other ways (no DRM or EULA). But that option almost never exists. I keep looking for ways to make it happen." http://stallman.org/stallman-computing.html http://stallman.org/stallman-computing.html