The foundation of a more secure web: Google Trust Services • Hacker News Board

Re: The foundation of a more secure web: Google Trust Services

#61

Post by zeveb » Thu, Jan 26, 2017, 9:57 PM UTC

satai wrote: post #5

asdfasdfasdfa12 wrote: post #2

I think SSL certificates need to be replaced. Security can NOT be designed with the 'good guy' in mind. if it can be broken at all we need an alternative.

The certificates are OK. The issue is the way they are signed and distributed. Lots of issues with the current PK infrastructure is limited by the certificate transparency.

> The certificates are OK.

No, the certificates are pretty terrible too. Take a look at Peter Gutmann's presentations, or read the SPKI RFCs.

Among other things, certificates conflate identification, authentication & authorisation; they are based on a flawed, centralised, global phone book model; they are ASN.1; in one case, I believe that the meaning of a single flag has been inverted because of a mistake in a (Microsoft?) library that everyone has had to be bug-compatible with.

Some folks think that XPKI is so broken precisely in order to discourage its use (others claim the same thing about IPsec). I don't actually think that's true, but sometimes when I'm banging my head against some stupidity in XPKI, I wonder. I really do.

Re: The foundation of a more secure web: Google Trust Services

#62

Post by pepr » Thu, Jan 26, 2017, 9:58 PM UTC

algesten wrote: post #40

JoshTriplett wrote: post #30

Earlier quoted context omitted.

> this feels wrong, though I can't quite pin point why. It's unusual for a root CA to be run by a service that otherwise has nothing to do with CA issuance, for the primary purpose of issuing certificates for that service's first-party sites, and not for third-party sites. I can't think of a single other example of a single-purpose root CA like this. (The announcement mentions that they might use this to operate as a…

I guess if NSA/FBI forces google to hand over the CA keys, they kan orchestrate undetectable MITM-attacks. I wonder why browser won't automatically store the fingerprint for every HTTPS-certificate it encounters and throw up a fuzz to the user if a certificate changes without any good reason?

Because the browser (or the user) has no way of knowing if the certificate changed for a good reason. Certificate pinning tries to tackle this at the CA level but it's not perfect (in a nutshell, browsers know that google.com can be signed only by a certain small subset of CAs).

Re: The foundation of a more secure web: Google Trust Services

#63

Post by WildUtah » Thu, Jan 26, 2017, 9:59 PM UTC

andy_ppp wrote: post #27

I mean people don't trust Google's motives but I trust the certificate authorities less... How do we (or Google) know that the CIA and FBI can't create certificates from all the CAs because they have stolen/demanded the Root CA for them? If I was a TLA I'd want the ability to perfectly MITM anyone. I think these questions imply that there needs to be a better way to think about security and trust for web endpoints in…

That's why the NSA opened Let's Encrypt, isn't it?

Re: The foundation of a more secure web: Google Trust Services

#64

Post by infogulch » Thu, Jan 26, 2017, 10:00 PM UTC

JoshTriplett wrote: post #59

infogulch wrote: post #50

Earlier quoted context omitted.

Why aren't new certificates for the same domain signed by the old (perhaps expired) certificate (recursively) in addition to the whole CA model? This proves that whoever has the new cert used to have the old cert. A browser would save a copy of a certificate the first time it visits a site, then when it visits again later it could request the chain of certs back to the first one it ever encountered. Past certs verify…

You'd need a backup plan for sites that have transferred ownership, or for sites that needed to revoke the old key due to compromise. And once you have that backup plan, how would you decide whether to care if that additional signature exists?

But ownership change and compromise should be communicated to the user. Maybe an "Unverified Identity" shows up for a while and triggers stronger checks in the browser for CT and revocation lists.

Re: The foundation of a more secure web: Google Trust Services

#65

Post by aduffy » Thu, Jan 26, 2017, 10:03 PM UTC

You can now have a website secured by a certificate issued by a Google CA, hosted on Google web infrastructure, with a domain registered using Google Domains, resolved using Google Public DNS, going over Google Fiber, in Google Chrome on a Google Chromebook. Google has officially vertically integrated the Internet.

Re: The foundation of a more secure web: Google Trust Services

#66

Post by zokier » Thu, Jan 26, 2017, 10:04 PM UTC

serge2k wrote: post #29

zokier wrote: post #22

Earlier quoted context omitted.

As far as I can tell, this is more like Goog gathering their own eggs in their own basket. They are becoming more and more self-sufficient, but don't really seem that interested in taking over the whole market. As long as it stays that way, I don't mind much.

They have the most popular browser, mobile OS, search engine. They operate popular public DNS servers too. They add this cert and they control a vast chunk of the internet.

This is different from all the things you mentioned by the virtue of not offering CA services to anyone (except themselves). So they are not really entering/disrupting any new market with this move.

Re: The foundation of a more secure web: Google Trust Services

#67

Post by wickedlogic » Thu, Jan 26, 2017, 10:05 PM UTC

niftich wrote: post #43

I don't think this is a bad thing. Instead of a third-party you trust (or rather, your user-agent trusts) vouching that Google's indeed Google, it's now Google vouching for itself, and you trust them by the virtue that they're Google. This ought not be surprising: presumably, who better to say that Google is indeed Google than Google itself? The reason everyone doesn't run a root CA is because it's difficult to coord…

But that is just it... "when" is not "if" here. There is a "when" it happens, and then a "when" we find out at some later point. Neither of those are reasonable "ifs".

There will be tremendous pressure on them to do it for certain parties, or have it done on their behalf unwillingly, or possibly unknowingly.

Re: The foundation of a more secure web: Google Trust Services

#68

Post by scalio » Thu, Jan 26, 2017, 10:09 PM UTC

algesten wrote: post #3

I have no love for most the major CAs I've interacted with, but this feels wrong, though I can't quite pin point why. Perhaps just a general feeling that all the internet eggs are being put, one by one, in one single alphabet basket.

I guess I'm not the only one who's noticed the steady stream of "Do x with google" on the frontpage. This is what's unsettling me, they seem to want to seep into every last crack of our lives, starting with all things web.

Edit: At least it felt like a slow stream to me. Search isn't being very cooperative towards my cause right now... The only item matching my memory is https://news.ycombinator.com/item?id=13013494 , but I'll be damned if there weren't others.

Re: The foundation of a more secure web: Google Trust Services

#69

Post by zokier » Thu, Jan 26, 2017, 10:13 PM UTC

mixedCase wrote: post #56

zokier wrote: post #15

It feels like a new age of internet when we have stuff like Googles private .goog gtld with domains signed by Googles private Root CA. It's not strictly bad (and I'm not complaining), but it feels bit silly/weird/scary/... .

Most of us adjudicate too much value to TLDs. It's an artificially scarce resource and most people here learned about the Internet when these TLDs were even scarcer.

Well, personally I think that most of us adjudicate too little value to TLDs. The point of DNS is to be hierarchical instead of one flat space, so imho all legacy TLDs should have been immediately deprecated the day ccTLDs were introduced, and countries should have been endorsed to maintain second level hierarchy (somewhat like .uk had for some time).

But of course that train left the station 30 years ago... in the current landscape I don't mind gTLDs any more than the general mess that is current DNS "hierarchy".

Re: The foundation of a more secure web: Google Trust Services

#70

Post by spullara » Thu, Jan 26, 2017, 10:15 PM UTC

aduffy wrote: post #65

You can now have a website secured by a certificate issued by a Google CA, hosted on Google web infrastructure, with a domain registered using Google Domains, resolved using Google Public DNS, going over Google Fiber, in Google Chrome on a Google Chromebook. Google has officially vertically integrated the Internet.

Funded mostly by you looking at Google Ads.