3 ms·

I don't understand why this is newsworthy? Everybody could generate an unsigned certificate for any name in just a few seconds. The point is that they are unusa

by t0mas88 13y ago

I don't understand why this is newsworthy? Everybody could generate an unsigned certificate for any name in just a few seconds. The point is that they are unusable in any sane browser.

ejain 13y ago
In browsers, yes, but what about apps? Search StackOverflow for e.g. "ssl ignore server certificate" and despair...
yeukhon 13y ago
That's not enough for some people. A somewhat stronger version would be to do PK pinning. But the consequence can be annoying and painful. --EDIT-- Opps they did mention PK pinning as a solution. Cool.
- PhantomGremlin 13y ago
  Pinning is still a joke, years after multiple known instances of malicious certificates in the wild. When will Firefox actually implement pinning in the browser itself, instead of via some random add-on? Supposedly Google pays Mozilla $300m/yr. If we can accept that astronomical number, then WTF happens to all that money? Trivial FF changes like moving tabs above the address bar. But useful improvements like pinning languish.
  - joosters 13y ago
    It's difficult to do, that's why. Pinning a certificate relies upon trusting someone. But who do you trust, and how do you decide upon a basis to trust them? With Chrome, the answer is easy. Google control the browser code, so you're implicitly trusting them anyway, and they're vouching for the certificates to their own sites, so you have good reason to accept what they say are the real certs. With Firefox, the picture is much more hazy. The certificates being pinned aren't owned by Mozilla (at least, for the functionality to be useful you want to pin certs from other places, unless you browse mozilla's website all day long). So someone at Mozilla has to vouch for a 3rd party's certificate. Why should we trust Mozilla at this? How would Mozilla decide who to trust when they say 'honest, this really is my certificate'? And even if we accepted mozilla's judgement, all this does is make them an authority. You know, like all those other certificate authorities that already do this job. So nothing will have changed and nothing will have been improved.
    - 7952 13y ago
      Essentially all these systems depend on maintaining the security of a private key which can be compromised in the same way as a client side password. DNS should be something that can give persistent assurance even if a site is compromised in the short term. If you give complete trust to the private key, you then need some kind of revocation scheme to remove that trust when it is compromised. Who runs the revocation list, and how do you authenticate the person revoking the certificate? The challenge is really to encourage offline authentication of DNS and SSL certificate changes. It should be something that can be put in a safe and requires physical attack to circumvent. Something permanent enough that loss would be unlikely, and would result in permanent revocation of the domain.

by t0mas88 13y ago

I don't understand why this is newsworthy? Everybody could generate an unsigned certificate for any name in just a few seconds. The point is that they are unusable in any sane browser.

ejain 13y ago

In browsers, yes, but what about apps? Search StackOverflow for e.g. "ssl ignore server certificate" and despair...

yeukhon 13y ago

That's not enough for some people. A somewhat stronger version would be to do PK pinning. But the consequence can be annoying and painful. --EDIT-- Opps they did mention PK pinning as a solution. Cool.

PhantomGremlin 13y ago
Pinning is still a joke, years after multiple known instances of malicious certificates in the wild. When will Firefox actually implement pinning in the browser itself, instead of via some random add-on? Supposedly Google pays Mozilla $300m/yr. If we can accept that astronomical number, then WTF happens to all that money? Trivial FF changes like moving tabs above the address bar. But useful improvements like pinning languish.
- joosters 13y ago
  It's difficult to do, that's why. Pinning a certificate relies upon trusting someone. But who do you trust, and how do you decide upon a basis to trust them? With Chrome, the answer is easy. Google control the browser code, so you're implicitly trusting them anyway, and they're vouching for the certificates to their own sites, so you have good reason to accept what they say are the real certs. With Firefox, the picture is much more hazy. The certificates being pinned aren't owned by Mozilla (at least, for the functionality to be useful you want to pin certs from other places, unless you browse mozilla's website all day long). So someone at Mozilla has to vouch for a 3rd party's certificate. Why should we trust Mozilla at this? How would Mozilla decide who to trust when they say 'honest, this really is my certificate'? And even if we accepted mozilla's judgement, all this does is make them an authority. You know, like all those other certificate authorities that already do this job. So nothing will have changed and nothing will have been improved.
  - 7952 13y ago
    Essentially all these systems depend on maintaining the security of a private key which can be compromised in the same way as a client side password. DNS should be something that can give persistent assurance even if a site is compromised in the short term. If you give complete trust to the private key, you then need some kind of revocation scheme to remove that trust when it is compromised. Who runs the revocation list, and how do you authenticate the person revoking the certificate? The challenge is really to encourage offline authentication of DNS and SSL certificate changes. It should be something that can be put in a safe and requires physical attack to circumvent. Something permanent enough that loss would be unlikely, and would result in permanent revocation of the domain.