6 ms·

I know we could SSL sigaint.org, but if it is a state-actor they could just use one of their CAs and mill a key. Please don't use that argument. It's like

by BoppreH 12y ago

I know we could SSL sigaint.org, but if it is a state-actor they could just use one of their CAs and mill a key. Please don't use that argument. It's like not putting a lock on your door because thieves can just bust it open anyway. It's true at face value, but you are ignoring that a) it keeps smaller attackers at bay and b) it makes noise when it breaks. In case of SSL the noise is that a user receives a valid but unusual certificate, which can be caught by something like the SSL Observatory (http://tor.stackexchange.com/a/1879 http://tor.stackexchange.com/a/1879).

mike_hearn 12y ago
Yeah, the fact that they would make such an argument is a big red flag to stay away from their service. There are currently zero known cases of intelligence agencies forcing CAs to sign bogus certs. If SIGAINT is the first victim of this approach then they will have done the whole security community a service by catching it and the CA that was coerced will be revoked. But if they never use SSL at all then it's wide open to anyone at all, not even just governments. And it's hardly like governments are the only threats against people who use such services.
- wyager 12y ago
  >There are currently zero known cases of intelligence agencies forcing CAs to sign bogus certs. https://www.eff.org/deeplinks/2011/05/syrian-man-middle-against-facebook https://www.eff.org/deeplinks/2011/05/syrian-man-middle-agai... https://www.eff.org/deeplinks/2011/08/iranian-man-middle-attack-against-google https://www.eff.org/deeplinks/2011/08/iranian-man-middle-att... http://securityaffairs.co/wordpress/32469/hacking/china-runs-mitm-outlook.html http://securityaffairs.co/wordpress/32469/hacking/china-runs... http://thehackernews.com/2014/10/chinese-government-executes-mitm-attack.html http://thehackernews.com/2014/10/chinese-government-executes...
  - iancarroll 12y ago
    > https://www.eff.org/deeplinks/2011/05/syrian-man-middle-agai.. https://www.eff.org/deeplinks/2011/05/syrian-man-middle-agai.... > The attack is not extremely sophisticated: the certificate is invalid in user's browsers, and raises a security warning. > https://www.eff.org/deeplinks/2011/08/iranian-man-middle-att.. https://www.eff.org/deeplinks/2011/08/iranian-man-middle-att.... DigiNotar was compromised, not compelled. > http://securityaffairs.co/wordpress/32469/hacking/china-runs.. http://securityaffairs.co/wordpress/32469/hacking/china-runs.... > the connection was established with a self-signed digital certificate. > http://thehackernews.com/2014/10/chinese-government-executes.. http://thehackernews.com/2014/10/chinese-government-executes.... > but the company’s SSL certificate is replaced by the intruders for a self-signed one
    - vesinisa 12y ago
      Fair point. I think the American TLAs know that the very day they are even once caught red-handed with a bogus CA-signed cert, the browser vendors will quickly start beefing up security with measures like DANE, making any attack on HTTPS even harder. This could also be disastrous to the breached CA's business, if browsers start rejecting it, which in turn could have major political implications - the overall revenue of the American CA companies measures in billions. Surely they would have otherwise already done it, right? They certainly have the capability to compel a CA to do it.
    - higherpurpose 12y ago
      France did it: https://nakedsecurity.sophos.com/2013/12/09/serious-security-google-finds-fake-but-trusted-ssl-certificates-for-its-domains-made-in-france/ https://nakedsecurity.sophos.com/2013/12/09/serious-security... http://googleonlinesecurity.blogspot.com/2013/12/further-improving-digital-certificate.html http://googleonlinesecurity.blogspot.com/2013/12/further-imp...
      - Buge 12y ago
        I don't see any evidence of an intelligence agency being involved or of the CA being forced to sign the certs. >ANSSI has found that the intermediate CA certificate was used in a commercial device, on a private network, to inspect encrypted traffic with the knowledge of the users on that network.
  - MertsA 12y ago
    Most of those are not cases where a CA was forced to sign anything, that's just the government using their own untrusted CA.
- LLWM 12y ago
  Nobody is going to stop one trusting of the huge CAs like DigiCert or Verisign over something like that. It'd be like deciding you're not going to use Windows because there is a bug in it - you're too dependent on it to give it up and the alternatives are just as bad.
  - thinkmassive 12y ago
    Who is too dependent on Windows and has no superior alternatives? This is a laughably weak argument that's getting weaker every day. It sounds like a personal problem.
    - LLWM 12y ago
      Most normal users.
    - jamroom 12y ago
      The 90%+ of computer users who have no idea how to install a different operating system?
    - irascible 12y ago
      Relax brainiac. Nobody cares about your hippie os.
    - task_queue 12y ago
      I've continued to inflict Linux upon myself as my main (laptop!) OS for 12 years now, but you're deluded if you think it has any place on normal human being's computer. Windows works and is expected. Expecting the user to spend hours/days learning a new system for reasons that aren't their own is bad assumption to make.
  - mike_hearn 12y ago
    If Verisign was discovered to be routinely minting fake certs for the US Govt then they would be revoked. It would probably take over a year and involve huge amounts of pain but yes, it could be done. CAs sell a commodity product and are entirely replaceable.
- verytrivial 12y ago
  Aside: There are literally dozens of CA keys baked into end user applications. An intel agency would only need to force some specific CA to sign a bogus cert if that agency somehow managed to not have the private key material to any of them. Any one will do to turn the padlock green, and that cert can be injected in a very targeted way. The agencies complained a lot in the 90s about this technology, then they stopped complaining. So, they've either stopped doing their job, or ...
  - MertsA 12y ago
    There's tons of CAs that can subvert security for most sites using SSL but also, if any of those CAs are caught issuing a bogus cert, which the cert presented to the user is proof of, they will be immediately blacklisted like DigiNotar and suddenly a whole CA is gone just for getting caught using it once.
    - throwaway7767 12y ago
      And yet, TrustWave gets to keep their certificate despite doing the same thing intentionally (as opposed to accidentally through incompetence). The system does not work.
    - verytrivial 12y ago
      Catching one of these forged certs "in the wild" is harder if it only ever appears on the targets connection. If they happen to be anyone other than the fraction of a percent of users who understand things like "pinning", it is very low risk (today at least). The ability to generate a CA cert trusted by a consumer CA store is a valuable asset that, like any intel asset, must be rationally deployed.
  - mike_hearn 12y ago
    > The agencies complained a lot in the 90s about this technology, then they stopped complaining. So, they've either stopped doing their job, or .... or they realised that nobody was deploying SSL outside of login forms and credit card purchases.
navait 12y ago
They don't even provide evidence as to why they think a state-actor is targeting them. The message seems like it was also built to promote their service.
- fabulist 12y ago
  I think it is mostly a result of their threat model -- they're a service which seeks to make things harder for those entities in particular.
tetrep 12y ago
not only that, but Chrome can pin certificates: chrome://net-internals/#hsts
userbinator 12y ago
Thar argument also assumes SSL using the traditional CA model. A self-signed certificate would completely eliminate a state actor or other rogue CA, as long as you have some other secure channel of disseminating the correct certificate publicly.
- peteretep 12y ago
  I wonder if keybase.io would work
  - ikeboy 12y ago
    And how are you authenticating keybase.io? SSL?
    - tokenizerrr 12y ago
      No, with a merkle tree and bitcoin: https://keybase.io/docs/server_security/merkle_root_in_bitcoin_blockchain https://keybase.io/docs/server_security/merkle_root_in_bitco...
      - ikeboy 12y ago
        So we're basically just trusting keybase.io to do verification, instead of the CA system, Why them and not anyone else?
        tokenizerrr 12y ago
        No. We're not. We're trusting math.
        Sanddancer 12y ago
        Trusting math alone is not enough. One of the reasons the CA system works is that there is a person who can be in the loop when things go cactus. With things like keybase, if your certificate gets compromised, that's it, game over man, game over. CAs, you can get certs replaced and the compromised certificate becomes worthless. However, this does show the need for a generic method of certificate pinning. Using a DNS record type or the like would be able to add to the trust model, and make it much harder for a malicious actor to use a fake key, all without tying your trust database to a financial transaction.

by BoppreH 12y ago

mike_hearn 12y ago

Yeah, the fact that they would make such an argument is a big red flag to stay away from their service. There are currently zero known cases of intelligence agencies forcing CAs to sign bogus certs. If SIGAINT is the first victim of this approach then they will have done the whole security community a service by catching it and the CA that was coerced will be revoked. But if they never use SSL at all then it's wide open to anyone at all, not even just governments. And it's hardly like governments are the only threats against people who use such services.

wyager 12y ago
>There are currently zero known cases of intelligence agencies forcing CAs to sign bogus certs. https://www.eff.org/deeplinks/2011/05/syrian-man-middle-against-facebook https://www.eff.org/deeplinks/2011/05/syrian-man-middle-agai... https://www.eff.org/deeplinks/2011/08/iranian-man-middle-attack-against-google https://www.eff.org/deeplinks/2011/08/iranian-man-middle-att... http://securityaffairs.co/wordpress/32469/hacking/china-runs-mitm-outlook.html http://securityaffairs.co/wordpress/32469/hacking/china-runs... http://thehackernews.com/2014/10/chinese-government-executes-mitm-attack.html http://thehackernews.com/2014/10/chinese-government-executes...
- iancarroll 12y ago
  > https://www.eff.org/deeplinks/2011/05/syrian-man-middle-agai.. https://www.eff.org/deeplinks/2011/05/syrian-man-middle-agai.... > The attack is not extremely sophisticated: the certificate is invalid in user's browsers, and raises a security warning. > https://www.eff.org/deeplinks/2011/08/iranian-man-middle-att.. https://www.eff.org/deeplinks/2011/08/iranian-man-middle-att.... DigiNotar was compromised, not compelled. > http://securityaffairs.co/wordpress/32469/hacking/china-runs.. http://securityaffairs.co/wordpress/32469/hacking/china-runs.... > the connection was established with a self-signed digital certificate. > http://thehackernews.com/2014/10/chinese-government-executes.. http://thehackernews.com/2014/10/chinese-government-executes.... > but the company’s SSL certificate is replaced by the intruders for a self-signed one
  - vesinisa 12y ago
    Fair point. I think the American TLAs know that the very day they are even once caught red-handed with a bogus CA-signed cert, the browser vendors will quickly start beefing up security with measures like DANE, making any attack on HTTPS even harder. This could also be disastrous to the breached CA's business, if browsers start rejecting it, which in turn could have major political implications - the overall revenue of the American CA companies measures in billions. Surely they would have otherwise already done it, right? They certainly have the capability to compel a CA to do it.
  - higherpurpose 12y ago
    France did it: https://nakedsecurity.sophos.com/2013/12/09/serious-security-google-finds-fake-but-trusted-ssl-certificates-for-its-domains-made-in-france/ https://nakedsecurity.sophos.com/2013/12/09/serious-security... http://googleonlinesecurity.blogspot.com/2013/12/further-improving-digital-certificate.html http://googleonlinesecurity.blogspot.com/2013/12/further-imp...
    - Buge 12y ago
      I don't see any evidence of an intelligence agency being involved or of the CA being forced to sign the certs. >ANSSI has found that the intermediate CA certificate was used in a commercial device, on a private network, to inspect encrypted traffic with the knowledge of the users on that network.
- MertsA 12y ago
  Most of those are not cases where a CA was forced to sign anything, that's just the government using their own untrusted CA.
LLWM 12y ago
Nobody is going to stop one trusting of the huge CAs like DigiCert or Verisign over something like that. It'd be like deciding you're not going to use Windows because there is a bug in it - you're too dependent on it to give it up and the alternatives are just as bad.
- thinkmassive 12y ago
  Who is too dependent on Windows and has no superior alternatives? This is a laughably weak argument that's getting weaker every day. It sounds like a personal problem.
  - LLWM 12y ago
    Most normal users.
  - jamroom 12y ago
    The 90%+ of computer users who have no idea how to install a different operating system?
  - irascible 12y ago
    Relax brainiac. Nobody cares about your hippie os.
  - task_queue 12y ago
    I've continued to inflict Linux upon myself as my main (laptop!) OS for 12 years now, but you're deluded if you think it has any place on normal human being's computer. Windows works and is expected. Expecting the user to spend hours/days learning a new system for reasons that aren't their own is bad assumption to make.
- mike_hearn 12y ago
  If Verisign was discovered to be routinely minting fake certs for the US Govt then they would be revoked. It would probably take over a year and involve huge amounts of pain but yes, it could be done. CAs sell a commodity product and are entirely replaceable.
verytrivial 12y ago
Aside: There are literally dozens of CA keys baked into end user applications. An intel agency would only need to force some specific CA to sign a bogus cert if that agency somehow managed to not have the private key material to any of them. Any one will do to turn the padlock green, and that cert can be injected in a very targeted way. The agencies complained a lot in the 90s about this technology, then they stopped complaining. So, they've either stopped doing their job, or ...
- MertsA 12y ago
  There's tons of CAs that can subvert security for most sites using SSL but also, if any of those CAs are caught issuing a bogus cert, which the cert presented to the user is proof of, they will be immediately blacklisted like DigiNotar and suddenly a whole CA is gone just for getting caught using it once.
  - throwaway7767 12y ago
    And yet, TrustWave gets to keep their certificate despite doing the same thing intentionally (as opposed to accidentally through incompetence). The system does not work.
  - verytrivial 12y ago
    Catching one of these forged certs "in the wild" is harder if it only ever appears on the targets connection. If they happen to be anyone other than the fraction of a percent of users who understand things like "pinning", it is very low risk (today at least). The ability to generate a CA cert trusted by a consumer CA store is a valuable asset that, like any intel asset, must be rationally deployed.
- mike_hearn 12y ago
  > The agencies complained a lot in the 90s about this technology, then they stopped complaining. So, they've either stopped doing their job, or .... or they realised that nobody was deploying SSL outside of login forms and credit card purchases.

navait 12y ago

They don't even provide evidence as to why they think a state-actor is targeting them. The message seems like it was also built to promote their service.

fabulist 12y ago
I think it is mostly a result of their threat model -- they're a service which seeks to make things harder for those entities in particular.

tetrep 12y ago

not only that, but Chrome can pin certificates: chrome://net-internals/#hsts

userbinator 12y ago

Thar argument also assumes SSL using the traditional CA model. A self-signed certificate would completely eliminate a state actor or other rogue CA, as long as you have some other secure channel of disseminating the correct certificate publicly.

peteretep 12y ago
I wonder if keybase.io would work
- ikeboy 12y ago
  And how are you authenticating keybase.io? SSL?
  - tokenizerrr 12y ago
    No, with a merkle tree and bitcoin: https://keybase.io/docs/server_security/merkle_root_in_bitcoin_blockchain https://keybase.io/docs/server_security/merkle_root_in_bitco...
    - ikeboy 12y ago
      So we're basically just trusting keybase.io to do verification, instead of the CA system, Why them and not anyone else?
      - tokenizerrr 12y ago
        No. We're not. We're trusting math.
        Sanddancer 12y ago
        Trusting math alone is not enough. One of the reasons the CA system works is that there is a person who can be in the loop when things go cactus. With things like keybase, if your certificate gets compromised, that's it, game over man, game over. CAs, you can get certs replaced and the compromised certificate becomes worthless. However, this does show the need for a generic method of certificate pinning. Using a DNS record type or the like would be able to add to the trust model, and make it much harder for a malicious actor to use a fake key, all without tying your trust database to a financial transaction.