4 ms·

Steve Gibson at it again. Lots of exclamation points, all caps, and colored text, but not a lot of substance. Chrome disabled cert revocation checks because t

by enneff 13y ago

Steve Gibson at it again. Lots of exclamation points, all caps, and colored text, but not a lot of substance. Chrome disabled cert revocation checks because they are easily bypassed: a MITM attacker can just block access to the CA's servers and the revocation check fails open. They instead opted for a more reliable method of pushing high profile revocations to the browser with software updates. These decisions are documented here: https://www.imperialviolet.org/2012/02/05/crlsets.html https://www.imperialviolet.org/2012/02/05/crlsets.html Notice how GRC doesn't give any actual details about how revocation checks are performed and the various advantages and disadvantages of doing them. In typical Gibson style, he is hyperbolic and cites no prior discussion. But of course these tactics do what they are designed to do: generate hysteria to get maximum page views.

unlimitedbacon 13y ago
I listen to his Security Now podcast on a regular basis and have always found it be be extremely thorough and informative. However, I have to agree with you that his website and writing style look like something you'd expect from someone who wears a tin foil hat. I also understand that he doesn't have much credibility in the wider security community. So I guess my question is, what do you guys think of the show and are there any alternatives you would recommend?
danra 13y ago
Post heartbleed, the right way to go is for all browsers to deny https access in case the OCSP check fails, not just ignore the failure. The CAs are those who should scramble to fix whatever doesn't work. Captive networks have to be configured to allow CA access, or just disallow https.
- nomailing 13y ago
  exactly. if access to a CA is blocked it is not good and I want a big red warning sign in my browser. what chrome is doing with their high profile website revocation by browser update is all bullshit.
borplk 13y ago
Bullshit. Firstly the cert revocation check does work. You are assuming an arbitrarily advanced adversary who is assumed to pull both an MITM and also attempt to block access to the CA's servers. When in reality that may very well not be the case. Just because someone is doing an MITM does not mean that they will also block access to the CA's servers. Secondly the MITM can happen at different levels. If the server that is sending you the response is being MITM'd but you are not, then you can safely access CA's servers and check for revocation. The MITM does not necessarily affect the client in a manner as to guarantee the failure to access the CA's servers. And finally these personal attacks and Steve Gibson bashing really gets old. Perhaps he made some mistakes or took controversial positions like ... when? 10 years ago? and people wont let it go. The exclamation points and all caps and colored text and the ugly web pages is just his utilitarian and old-school style. I listen to his weekly Security Now podcast and without failure he is well-prepared, thorough, accurate and correct. Even when he makes a small mistake next week he comes along, specifies the exact mistake and apologises and corrects it. Instead every time he is mentioned someone comes along and says "ew hurr durr 10 years ago he said something about raw sockets in XP". My point is, no one is perfect, and he certainly has not done anything to deserve these personal bashings and attacks from the community, if anything he is a long-time contributor, has put many tools available online and is now developing the SQRL login systems in the public ... so ... give him a break.
- enneff 13y ago
  By far the most common MITM attack is through untrusted WiFi networks. That's when SSL is most valuable to the user, and also when it's easiest for an attacker to block access to CA servers. Other kinds of MITM attacks are so much less common they're barely worth talking about in this context. IMO, an adversary that can extract a cert using Heartbleed and set up a MITM should also be advanced enough to block some IP addresses. I'm confused by the rest of your comments about Gibson. All I said about him was that he continues to generate hysteria without providing details or citing prior discussion. The only things I'm accusing him of are things he is still doing today.
  - shadearg 13y ago

by enneff 13y ago

unlimitedbacon 13y ago

I listen to his Security Now podcast on a regular basis and have always found it be be extremely thorough and informative. However, I have to agree with you that his website and writing style look like something you'd expect from someone who wears a tin foil hat. I also understand that he doesn't have much credibility in the wider security community. So I guess my question is, what do you guys think of the show and are there any alternatives you would recommend?

danra 13y ago

Post heartbleed, the right way to go is for all browsers to deny https access in case the OCSP check fails, not just ignore the failure. The CAs are those who should scramble to fix whatever doesn't work. Captive networks have to be configured to allow CA access, or just disallow https.

nomailing 13y ago
exactly. if access to a CA is blocked it is not good and I want a big red warning sign in my browser. what chrome is doing with their high profile website revocation by browser update is all bullshit.

borplk 13y ago

Bullshit. Firstly the cert revocation check does work. You are assuming an arbitrarily advanced adversary who is assumed to pull both an MITM and also attempt to block access to the CA's servers. When in reality that may very well not be the case. Just because someone is doing an MITM does not mean that they will also block access to the CA's servers. Secondly the MITM can happen at different levels. If the server that is sending you the response is being MITM'd but you are not, then you can safely access CA's servers and check for revocation. The MITM does not necessarily affect the client in a manner as to guarantee the failure to access the CA's servers. And finally these personal attacks and Steve Gibson bashing really gets old. Perhaps he made some mistakes or took controversial positions like ... when? 10 years ago? and people wont let it go. The exclamation points and all caps and colored text and the ugly web pages is just his utilitarian and old-school style. I listen to his weekly Security Now podcast and without failure he is well-prepared, thorough, accurate and correct. Even when he makes a small mistake next week he comes along, specifies the exact mistake and apologises and corrects it. Instead every time he is mentioned someone comes along and says "ew hurr durr 10 years ago he said something about raw sockets in XP". My point is, no one is perfect, and he certainly has not done anything to deserve these personal bashings and attacks from the community, if anything he is a long-time contributor, has put many tools available online and is now developing the SQRL login systems in the public ... so ... give him a break.

enneff 13y ago
By far the most common MITM attack is through untrusted WiFi networks. That's when SSL is most valuable to the user, and also when it's easiest for an attacker to block access to CA servers. Other kinds of MITM attacks are so much less common they're barely worth talking about in this context. IMO, an adversary that can extract a cert using Heartbleed and set up a MITM should also be advanced enough to block some IP addresses. I'm confused by the rest of your comments about Gibson. All I said about him was that he continues to generate hysteria without providing details or citing prior discussion. The only things I'm accusing him of are things he is still doing today.
- shadearg 13y ago