4 ms·
We have some large websites on board to deploy it, and Trevor has been working with browser vendors to get it integrated. The latter has been pretty slow going
by moxie 13y ago
We have some large websites on board to deploy it, and Trevor has been working with browser vendors to get it integrated. The latter has been pretty slow going, but there is interest.
- devx 13y agoMaybe browser vendors will take it more seriously now, and with more urgency.
- randall 13y agoEspecially one who's already had other services attacked. (Google)
- StavrosK 13y agoThis isn't a promise or official or anything, but I'm fairly sure that Silent Circle will be interested in deploying TACK. I can put it on the table, if you want, but anything that increases security will be welcome. Also, how does TACK relate to certificate pinning? The introduction has a few differences (e.g. tack expiration), but the two techniques seem pretty similar, am I missing something?
- trevp 13y agoThat would be great, we have a mailing list interested people should monitor, we'll definitely let people know once things get far enough for sites to start testing the waters. https://lists.riseup.net/www/arc/tack https://lists.riseup.net/www/arc/tack Regarding certificate pinning: TACK is a different "style" of pinning, it lets you pin to a self-managed signing key instead of certificate keys. So it gives you more control and security than CA pinning, if you're willing to assume more key management responsibilities (storing a TACK private key, and using it to sign new TLS keys). I think there's room for both approaches: I'd like to see CA pinning be made easy enough that most sites could deploy a fairly safe, simple pin to popular CAs, while high-security sites make use of TACK pins. But we'll see how things go.
- StavrosK 13y agoThanks, I will sign up to the list now. So, if I understand it correctly, TACK allows you to become your own CA. I will read the spec for more information (e.g. what prevents the MITM from becoming my CA?) but it sounds very interesting, thanks again.
- trevp 13y agoRe "become your own CA" - that's basically the idea. The "pin activation" algorithm is intended to make it difficult for a MITM to foist bad pins on clients, and to limit the lifetime of such pins.