3 ms·

You can't have encryption without authentication. So self-signed needs an error because it looks exactly like an attack. The only time its OK to not warn about

You can't have encryption without authentication. So self-signed needs an error because it looks exactly like an attack. The only time its OK to not warn about self-signed is if you're using HTTP (unencrypted) and the browser did some opportunistic upgrade to prevent totally passive attacks. But no indicator of security should be shown at all.

nadams 11y ago
> You can't have encryption without authentication. Sure you can - symmetric encryption. If you have the same key to encrypt and decrypt - you can't be sure you are talking to a good guy on the other end. I think what you mean is you can't have secure communication over HTTP without authentication - which I would agree with. But there are ways to accomplish that without a CA such as certificate pinning. Right now though - only technical people would know how to do that. There should be a non-scary button that shows up the first time to a friendly page that says "I don't trust the certificate that was presented - but this is the first time you are going to the page - would you like for me to continue and remember the certificate for future connections?" Obviously something a little more user friendly - but I think you get the idea. > So self-signed needs an error because it looks exactly like an attack. Same logic applies to HTTP then - without SSL you can't know for sure if there is an attacker in the middle or even if you are talking to a bad guys server. Self signed certificate will at least make it so that people that web traffic sent over open wifi won't be sent in the clear. It could be a guy doing a MITM attack - sure but he could have just as easily MITM your HTTP traffic. However, showing an error page for HTTP traffic would be insane and have a huge drop in web traffic due to people not knowing what to do. You seem to be in favor of the current CA system - if recent history has taught us anything (superfish ring a bell?) - that the current system is completely and utterly broken. Do you check on a regular basis the list of CA certs that are installed on your system? If not - how do you know that you don't have a CA cert that was put there without your knowledge - that would allow someone to sign an SSL certificate for any domain on the planet and your computer or mobile device will automatically accept it.
- MichaelGG 11y ago
  Unauthenticated symmetric encryption is full of problems. Using the HTTPS URI schema indicates you're asking for a secured connection. That is why the errors exist. Not because of some general security principle. HTTP has no security connotation hence no issues. The CA system isn't great. But it's far from totally broken. Ask CNNIC about how issuing bad CA certs worked out for them.
  - nadams 11y ago
    > Using the HTTPS URI schema indicates you're asking for a secured connection. That is why the errors exist. Having a self signed certificate isn't an error in the encryption negotiation (fatal) but a policy error (non-fatal). In technical terms - there is nothing wrong with a self signed certificate preventing me from having an encrypted session. > HTTP has no security connotation hence no issues. I think you just pointed out the problem - HTTP shouldn't exist at all - we should be migrating everything to HTTPS or some other protocol. I'm not sure letsencrypt is the answer - it might just turn into another non-maintained CA (see startssl). > But it's far from totally broken. The simple fact that CAs can, and have, been compromised in the past proves they are broken. If a fraudulent certificate is signed - it doesn't matter if is added to a CRL in 5 hours or 5 minutes - the bad guy has probably already used it to do damage. I'm not saying CAs are pointless - I'm advocating for a way to have a CA that is only allowed to sign certificates for certain domains - especially if I can be my own CA. Yes, I know that's not the way it works now - but surely we can modify the infrastructure to allow this.
    - MichaelGG 11y ago
      > In technical terms - there is nothing wrong with a self signed certificate preventing me from having an encrypted session. Yes there is - the ability to verify identity and hence actually prevent MITM attacks. (And in most cases where an attacker has access to read a network, they can write to it, too.) You can't ignore key distribution no matter how annoying it is. It's really that simple. If a CA issues a false cert, that becomes a mathematical fact, and the CA gets revoked. Few entities can afford to burn lots of CAs. But anyways, plenty of people are working on this issue, with many suggestions, some even in place (cert pinning). Some trade the current CAs for total trust in the registrars. Others rely on reporting and monitoring to try to build up an idea of trustworthiness (e.g., if a site is presenting you a new cert from a different CA, especially if others aren't seeing it, alarm). Security here is simply not a binary thing.

nadams 11y ago

> You can't have encryption without authentication. Sure you can - symmetric encryption. If you have the same key to encrypt and decrypt - you can't be sure you are talking to a good guy on the other end. I think what you mean is you can't have secure communication over HTTP without authentication - which I would agree with. But there are ways to accomplish that without a CA such as certificate pinning. Right now though - only technical people would know how to do that. There should be a non-scary button that shows up the first time to a friendly page that says "I don't trust the certificate that was presented - but this is the first time you are going to the page - would you like for me to continue and remember the certificate for future connections?" Obviously something a little more user friendly - but I think you get the idea. > So self-signed needs an error because it looks exactly like an attack. Same logic applies to HTTP then - without SSL you can't know for sure if there is an attacker in the middle or even if you are talking to a bad guys server. Self signed certificate will at least make it so that people that web traffic sent over open wifi won't be sent in the clear. It could be a guy doing a MITM attack - sure but he could have just as easily MITM your HTTP traffic. However, showing an error page for HTTP traffic would be insane and have a huge drop in web traffic due to people not knowing what to do. You seem to be in favor of the current CA system - if recent history has taught us anything (superfish ring a bell?) - that the current system is completely and utterly broken. Do you check on a regular basis the list of CA certs that are installed on your system? If not - how do you know that you don't have a CA cert that was put there without your knowledge - that would allow someone to sign an SSL certificate for any domain on the planet and your computer or mobile device will automatically accept it.

MichaelGG 11y ago
Unauthenticated symmetric encryption is full of problems. Using the HTTPS URI schema indicates you're asking for a secured connection. That is why the errors exist. Not because of some general security principle. HTTP has no security connotation hence no issues. The CA system isn't great. But it's far from totally broken. Ask CNNIC about how issuing bad CA certs worked out for them.
- nadams 11y ago
  > Using the HTTPS URI schema indicates you're asking for a secured connection. That is why the errors exist. Having a self signed certificate isn't an error in the encryption negotiation (fatal) but a policy error (non-fatal). In technical terms - there is nothing wrong with a self signed certificate preventing me from having an encrypted session. > HTTP has no security connotation hence no issues. I think you just pointed out the problem - HTTP shouldn't exist at all - we should be migrating everything to HTTPS or some other protocol. I'm not sure letsencrypt is the answer - it might just turn into another non-maintained CA (see startssl). > But it's far from totally broken. The simple fact that CAs can, and have, been compromised in the past proves they are broken. If a fraudulent certificate is signed - it doesn't matter if is added to a CRL in 5 hours or 5 minutes - the bad guy has probably already used it to do damage. I'm not saying CAs are pointless - I'm advocating for a way to have a CA that is only allowed to sign certificates for certain domains - especially if I can be my own CA. Yes, I know that's not the way it works now - but surely we can modify the infrastructure to allow this.
  - MichaelGG 11y ago
    > In technical terms - there is nothing wrong with a self signed certificate preventing me from having an encrypted session. Yes there is - the ability to verify identity and hence actually prevent MITM attacks. (And in most cases where an attacker has access to read a network, they can write to it, too.) You can't ignore key distribution no matter how annoying it is. It's really that simple. If a CA issues a false cert, that becomes a mathematical fact, and the CA gets revoked. Few entities can afford to burn lots of CAs. But anyways, plenty of people are working on this issue, with many suggestions, some even in place (cert pinning). Some trade the current CAs for total trust in the registrars. Others rely on reporting and monitoring to try to build up an idea of trustworthiness (e.g., if a site is presenting you a new cert from a different CA, especially if others aren't seeing it, alarm). Security here is simply not a binary thing.