4 ms·

VeriSign (.COM) already is a CA, and browsers cannot blacklist them. The CA is just too popular for that: any browser that did that would be seen as "the brow

• tptacek 11y ago
  Sure it is: X.509 might be de facto controlled by NSA and GCHQ, but DNSSEC is de jure controlled by them. We're in the midst of what will be a decade-long X.509 cleanup effort, disentangling untrustworthy CAs (all of them) from the outsized role they have in the Internet trust model. CT logs will play a role. Nuking egregiously bad CAs will play a role. The adoption of new cheap/free CAs like LetsEncrypt will play a role. Certificate pinning and HPKP will play a role. We are not in the midst of any effort at disentangling NSA and GCHQ from the DNS, nor will we ever be: that entanglement is by design in DNSSEC.
  • amalcon 11y ago
    X.509 is de facto controlled by every major intelligence agency in the world, which is obviously worse than just one. And the "X.509 cleanup effort" you refer to (really several entirely separate initiatives) has basically no chance of disentangling CAs from governments. Certificate pinning is the only piece that can gain traction without explicit support of governments (except cheap/free CAs, which solve a different problem). That's great for things you use all the time from a single device, but otherwise useless.
    • tptacek 11y ago
      Why do I care how many intelligence agencies have their hooks into CAs? DNSSEC is permanently compromised by the two I'm most worried about: NSA and, worse, GCHQ, the world's most unhinged SIGINT agency. I gave a whole list of ways in which "the security system formerly known as X.509" is being repaired. You rebutted basically no part of that list. For instance: I remain totally unclear on why you think CT logs require government cooperation. You've also oversimplified pinning. Pinning isn't simply "trust on first use" for TLS. It works in conjunction with the CA system. To break a pin, you have to implicate a CA. That means every time someone tries to deploy a fake CA certificate, they risk bumping into one of the tens of millions of deployed browsers that check pins; if they do, the browser vendors get evidence that the CA is compromised.
      • amalcon 11y ago
        OK, then, if you insist on a point-by-point rebuttal: - CT logs will play a role. Requires CA cooperation, and therefore government cooperation because the largest CAs are owned by governments. - Nuking egregiously bad CAs will play a role. This can only be done for small (i.e. non government owned) CAs, or you create the perception that your browser does not work. - The adoption of new cheap/free CAs like LetsEncrypt will play a role. This solves a real problem, but a different problem than this. - Certificate pinning and HPKP will play a role. This only helps in two cases: sites I use often and widespread attacks. Widespread HTTPS MITM is detectable anyway.
        • tptacek 11y ago
          Large CAs, including Symantec, are already cooperating with CT. CAs will enroll in CT because if they don't, they won't be able to sell higher-value products (like the EV bar) to their users. The problems with DNSSEC seem so obvious to me, and, obviously, I have problems taking pro-DNSSEC arguments seriously. I'm curious though; you sound plenty smart. What is it about DNSSEC that you actually like?
          • amalcon 11y ago
            Oh, don't get me wrong: I actually like absolutely nothing about DNSSEC. I just don't think "It has a worse security model than HTTPS" is a true statement. I think smart people need to keep working on the authentication problem, because we clearly have not solved it yet -- including with DNSSEC.
            • yuhong 11y ago
              Yea, I have been thinking about a DNSSEC2 that would for example uses online signing for a while now, in addition to things like DNSCurve/DNSCrypt.
        • idlewords 11y ago
          That first case ("sites I use often") seems like a pretty big win. I want my browser crying holy murder if my bank or webmail cert suddenly changes.