Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The foundation of a more secure web: Google Trust Services

security.googleblog.com

Post reply on HN
Print view View original

21–30 of 178 posts

Re: The foundation of a more secure web: Google Trust Services

#21

Post by amalag »

satai wrote: post #5
asdfasdfasdfa12 wrote: post #2

I think SSL certificates need to be replaced. Security can NOT be designed with the 'good guy' in mind. if it can be broken at all we need an alternative.

The certificates are OK. The issue is the way they are signed and distributed. Lots of issues with the current PK infrastructure is limited by the certificate transparency.

The main issue I see is ease of MITM for corporate environments. In a corporate environment a trusted root is installed, then an appliance can intercept all SSL certs and re-create the trust chain to introduce their own trusted root so they can read all SSL traffic and your browser says "SECURE". That is broken IMO.

Re: The foundation of a more secure web: Google Trust Services

#22

Post by zokier »

algesten wrote: post #3

I have no love for most the major CAs I've interacted with, but this feels wrong, though I can't quite pin point why. Perhaps just a general feeling that all the internet eggs are being put, one by one, in one single alphabet basket.

As far as I can tell, this is more like Goog gathering their own eggs in their own basket. They are becoming more and more self-sufficient, but don't really seem that interested in taking over the whole market. As long as it stays that way, I don't mind much.

Re: The foundation of a more secure web: Google Trust Services

#23

Post by asdfasdfasdfa12 »

satai wrote: post #20
asdfasdfasdfa12 wrote: post #18

Earlier quoted context omitted.

it is too hard for me to believe that root ca's have not been compromised when anyone working at these companies could likely easily take it without anyone noticing. I do not think transparency has anything at all to do with it. I think an encryption solutions that cannot be 'broken' for decryption is far more required than one that has the 'good guy' in mind. I do not find it an acceptable solution for critical data…

Not any transparency. Certificate transparency. https://en.m.wikipedia.org/wiki/Certificate_Transparency

I think we are talking on different lines of thought. I am not concerned with certificate transparency... as the article you point out says it can take a long time [years] before it is found to be compromised. the fact of the matter is, if ssl decryption is possible on the fly, we need a different solution for encryption, this include the use of credit card chip.

an encryption scheme cannot be designed to be broken and expect everything to be 'secure'

EDIT: I am not being allowed to reply.

excuse me, I think you need to read what I wrote more carefully. I do not care about certificate transparency. I must not be communicating clearly I will try again..

I am not referring to the ability to issue a new certificate.

I'm talking about the ability to perform SSL decryption without the end user knowing. you do not need to issue a new certificate to do this, you just need the end user to have trusted a new root CA... which brings us to this article where another company is issuing a root CA. do you trust everyone in your 'trusted root ca's on your computer?

Here are some ways to untrust certs [0][1]and another conversation on this [2]

[0]http://unix.stackexchange.com/questions/285784/untrusting-an...

[1] https://blog.filippo.io/untrusting-an-intermediate-ca-on-os-...

[2] https://news.ycombinator.com/item?id=11781915

Re: The foundation of a more secure web: Google Trust Services

#24

Post by agl »

reddiric wrote: post #4

"If you are building products that intends to connect to a Google property moving forward you need to at a minimum include the above Root Certificates." The foundation of a more secure web apparently requires you to trust Google with the entire internet, using their properties as leverage to force it to be so.

Google has had an intermediate CA for many years (GIAG2) so, if you don't trust Google, this doesn't make things any worse for you.

Re: The foundation of a more secure web: Google Trust Services

#25

Post by asdfasdfasdfa12 »

amalag wrote: post #21
satai wrote: post #5

Earlier quoted context omitted.

The certificates are OK. The issue is the way they are signed and distributed. Lots of issues with the current PK infrastructure is limited by the certificate transparency.

The main issue I see is ease of MITM for corporate environments. In a corporate environment a trusted root is installed, then an appliance can intercept all SSL certs and re-create the trust chain to introduce their own trusted root so they can read all SSL traffic and your browser says "SECURE". That is broken IMO.

This.

Thank you for constructing the words I could not.

Re: The foundation of a more secure web: Google Trust Services

#26

Post by noinsight »

satai wrote: post #9
algesten wrote: post #3

I have no love for most the major CAs I've interacted with, but this feels wrong, though I can't quite pin point why. Perhaps just a general feeling that all the internet eggs are being put, one by one, in one single alphabet basket.

Let's hope they stick to publishing all certificates into the certificate transparency list (Merkle tree).

They should be - they're making certificate transparency logs mandatory in 2017 [1].

[1] https://casecurity.org/2016/11/08/google-certificate-transpa...

Re: The foundation of a more secure web: Google Trust Services

#27

Post by andy_ppp »

I mean people don't trust Google's motives but I trust the certificate authorities less...

How do we (or Google) know that the CIA and FBI can't create certificates from all the CAs because they have stolen/demanded the Root CA for them?

If I was a TLA I'd want the ability to perfectly MITM anyone.

I think these questions imply that there needs to be a better way to think about security and trust for web endpoints in the days of the state as a bad actor.

Re: The foundation of a more secure web: Google Trust Services

#29

Post by serge2k »

zokier wrote: post #22
algesten wrote: post #3

I have no love for most the major CAs I've interacted with, but this feels wrong, though I can't quite pin point why. Perhaps just a general feeling that all the internet eggs are being put, one by one, in one single alphabet basket.

As far as I can tell, this is more like Goog gathering their own eggs in their own basket. They are becoming more and more self-sufficient, but don't really seem that interested in taking over the whole market. As long as it stays that way, I don't mind much.

They have the most popular browser, mobile OS, search engine. They operate popular public DNS servers too.

They add this cert and they control a vast chunk of the internet.

Re: The foundation of a more secure web: Google Trust Services

#30

Post by JoshTriplett »

algesten wrote: post #3

I have no love for most the major CAs I've interacted with, but this feels wrong, though I can't quite pin point why. Perhaps just a general feeling that all the internet eggs are being put, one by one, in one single alphabet basket.

> this feels wrong, though I can't quite pin point why.

It's unusual for a root CA to be run by a service that otherwise has nothing to do with CA issuance, for the primary purpose of issuing certificates for that service's first-party sites, and not for third-party sites. I can't think of a single other example of a single-purpose root CA like this.

(The announcement mentions that they might use this to operate as a CA for third-party sites as well, but right now it exists to certify first-party sites.)

Post reply on HN