Progress Towards 100% HTTPS, June 2016 • Hacker News Board

Re: Progress Towards 100% HTTPS, June 2016

#51

Post by agwa » Wed, Jun 22, 2016, 7:43 PM UTC

criddell wrote: post #38

agwa wrote: post #27

Earlier quoted context omitted.

> How long before Symantec gets an NSL demanding an appliance that can mint bogus certs on the fly for dropbox.com, facebook.com, twitter.com, etc...? If the bogus certs are not logged in Certificate Transparency, they will be rejected by Chrome: https://security.googleblog.com/2015/10/sustaining-digital-c... If they are logged in Certificate Transparency, then the world will know, the offending certificates will be…

From the link you posted: > However, we were still able to find several more questionable certificates using only the Certificate Transparency logs and a few minutes of work. We shared these results with other root store operators on October 6th, to allow them to independently assess and verify our research. So finding questionable certificates is trivially easy, but nobody ever bothers to look? What good is that?

"Nobody"? Google monitors for their domains. So does Facebook. I'll bet a lot of other high value sites are monitoring too but haven't said so publicly.

As for everyone else, give it some time. The ecosystem is still very young and we're still developing tooling.

Re: Progress Towards 100% HTTPS, June 2016

#52

Post by pfg » Wed, Jun 22, 2016, 7:43 PM UTC

criddell wrote: post #38

agwa wrote: post #27

Earlier quoted context omitted.

> How long before Symantec gets an NSL demanding an appliance that can mint bogus certs on the fly for dropbox.com, facebook.com, twitter.com, etc...? If the bogus certs are not logged in Certificate Transparency, they will be rejected by Chrome: https://security.googleblog.com/2015/10/sustaining-digital-c... If they are logged in Certificate Transparency, then the world will know, the offending certificates will be…

From the link you posted: > However, we were still able to find several more questionable certificates using only the Certificate Transparency logs and a few minutes of work. We shared these results with other root store operators on October 6th, to allow them to independently assess and verify our research. So finding questionable certificates is trivially easy, but nobody ever bothers to look? What good is that?

It's a fairly new project (in "internet standard/security technology" years), first introduced in 2013. CT Monitoring/Auditing is basically a group effort, being most effective when everyone from domain owners, browser vendors to CAs use it. There are usually no easy and instant solutions to complex problems, but it's getting there.

Re: Progress Towards 100% HTTPS, June 2016

#53

Post by 5ilv3r » Wed, Jun 22, 2016, 7:43 PM UTC

euyyn wrote: post #45

5ilv3r wrote: post #25

Earlier quoted context omitted.

Why should you trust me if you have never met me? If you like what I do, trust me, and please give me money. :) Cert companies only do a phone call check for the very expensive EV certs. There is no minimal to extensive checking. That is a scam. Web tech is all https now. I can't even browse a lot of https sites with some of my older devices. There is a requirement and I dislike it.

> I can't even browse a lot of https sites with some of my older devices. What devices do you have that don't support TLS? Also, the point is not to trust you or not, it's to trust that I'm actually talking to you and not a MitM.

Libretto 50ct. If 301s from http:// to https:// didn't exist, then I wouldn't have anything to complain about.

Re: Progress Towards 100% HTTPS, June 2016

#54

Post by pfg » Wed, Jun 22, 2016, 7:49 PM UTC

5ilv3r wrote: post #28

schoen wrote: post #20

Earlier quoted context omitted.

> I don't think they would be considered fraudulent at all Er, by whom?

Well, they would be as technically valid as any other updated cert, and they would not violate any laws since a judge somewhere would have rubber stamped it, so I just don't think that word fraudulent could apply in any actionable sense. Morally wrong, sure, but you know, politicians and law enforcement...

Fraudulent is not usually a term that's referring to legal assessments when talking about the CA system. Various browsers and root programs are (to keep the comparison) both the executive and judiciary branch of the CA system, and if certificates are issued in a way that's not allowed in those policies (which would certainly be the case in this scenario), it would be considered fraudulent and could lead to root removal.

Re: Progress Towards 100% HTTPS, June 2016

#55

Post by ocdtrekkie » Wed, Jun 22, 2016, 7:52 PM UTC

zzzcpan wrote: post #7

Is it still problematic to issue lots of certs for lots of subdomains? I mean, still no wildcard certs and crazy rate limits, that disallow issuing 1000s of certs per day for user-generated subdomains?

Wildcard certs are also a huge need for platforms like Sandstorm.io which opens documents on arbitrary/randomly-generated subdomains. And as someone who hosts a lot of things on various subdomains in general, the idea of having a bunch of different certs is far less appealing than a wildcard cert.

But unfortunately it doesn't seem like Let's Encrypt currently has any plans to add wildcard certs any time soon.

Re: Progress Towards 100% HTTPS, June 2016

#56

Post by Animats » Wed, Jun 22, 2016, 7:54 PM UTC

I see this as security theater. Most web pages don't need to be encrypted. Anything with a form should be, but if you're just viewing static content, there's little point. Yes, it obscures what content you're viewing, slightly. An observer often could figure that out from the file length.

Encrypting everything increases the demand for low-rent SSL certs. Anything below OV (Organization Validated) is junk, and if money is involved, an EV (Extended Validation) cert should be used. Trying to encrypt everything leads to messes such as Cloudflare's MITM certs which name hundreds of unrelated domains. This is a step backwards.

Re: Progress Towards 100% HTTPS, June 2016

#57

Post by criddell » Wed, Jun 22, 2016, 7:54 PM UTC

agwa wrote: post #51

criddell wrote: post #38

Earlier quoted context omitted.

From the link you posted: > However, we were still able to find several more questionable certificates using only the Certificate Transparency logs and a few minutes of work. We shared these results with other root store operators on October 6th, to allow them to independently assess and verify our research. So finding questionable certificates is trivially easy, but nobody ever bothers to look? What good is that?

"Nobody"? Google monitors for their domains. So does Facebook. I'll bet a lot of other high value sites are monitoring too but haven't said so publicly. As for everyone else, give it some time. The ecosystem is still very young and we're still developing tooling.

I'm happy that Google and Facebook are discovering fraudulent certs. When they pop up, hopefully those companies aren't prevented from going public with the information.

Are there any end-user tools? When I open twitter.com, I would love for my browser (or my phone if I'm using an app) to tell me that the certificate fingerprint has changed unexpectedly since the last time I visited.

Re: Progress Towards 100% HTTPS, June 2016

#58

Post by 5ilv3r » Wed, Jun 22, 2016, 7:56 PM UTC

drzaiusapelord wrote: post #39

5ilv3r wrote: post #16

I'm still bitter about this chain of trust model. The fact that I have to get some other party to tell my users that they can trust me just seems wrong. They trust me because of personal history, not because some banner says they should. Browsers and OS vendors shipping CAs seems to be the root of the problem, in my mind. Those should be distributed by the service providers, who are the actual trustworthy entities in…

Its a bit like gun control laws; ultimately the criminals won't follow them. I was reading about some recent attacks and how hackers just steal certs or fool CA's into making certs for them. My understanding is that this is trivial for them to do in most cases. Turns out most CA's are run like security shitshows. Meanwhile at work we're juggling dozens of certs left and right each with their own expiry as a handout t…

Nailed it, but my concerns about manipulation extend farther than criminal abuse. It's more about privacy to me.

Re: Progress Towards 100% HTTPS, June 2016

#59

Post by mholt » Wed, Jun 22, 2016, 7:58 PM UTC

Animats wrote: post #56

I see this as security theater. Most web pages don't need to be encrypted. Anything with a form should be, but if you're just viewing static content, there's little point. Yes, it obscures what content you're viewing, slightly. An observer often could figure that out from the file length. Encrypting everything increases the demand for low-rent SSL certs. Anything below OV (Organization Validated) is junk, and if mone…

Sorry, but your comment is literally all wrong.

Re: Progress Towards 100% HTTPS, June 2016

#60

Post by mieko » Wed, Jun 22, 2016, 8:01 PM UTC

tracker1 wrote: post #13

zzzcpan wrote: post #7

Is it still problematic to issue lots of certs for lots of subdomains? I mean, still no wildcard certs and crazy rate limits, that disallow issuing 1000s of certs per day for user-generated subdomains?

If you're generating that many subdomains (and you control the subdomains), it's probably worth investing in a traditional wildcard cert. Though, it would be nice if the likes of dyndns names were given exception, since they are effectively second level tld's.

LE uses the Public Suffix List to decide what's a "domain". Their really-low rate limits have caused a flood of applications which are overwhelming the PSL's maintainers.

https://community.letsencrypt.org/t/dyndns-no-ip-managed-dns...