Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The foundation of a more secure web: Google Trust Services

security.googleblog.com

Post reply on HN
Print view View original

131–140 of 178 posts

Re: The foundation of a more secure web: Google Trust Services

#131

Post by imatworkyo »

tyingq wrote: post #95
algesten wrote: post #3

I have no love for most the major CAs I've interacted with, but this feels wrong, though I can't quite pin point why. Perhaps just a general feeling that all the internet eggs are being put, one by one, in one single alphabet basket.

They control a popular public dns server, a CA, a global local cache, and control over the most popular browser and phone. They have all the pieces to do almost seamless MITM. "We see you haven't signed up yet for AMP, so we've done the work for you" Yes, I get they wouldn't do this, but the fact that they could is a little scary.

whats even more scary, is Google being able to tell what site is valid/secure. Imagine the implications if they limited who could get CA's or decided the information on your site was harmful

Re: The foundation of a more secure web: Google Trust Services

#133

Post by xj9 »

exolymph wrote: post #121
viraptor wrote: post #80

Earlier quoted context omitted.

We still need to make choices that guarantee it's the case in the future. We need to ensure we don't end up with environment as diverse as email where most people use Gmail, or Linux services which are all being rewritten under systemd, or many other cases where we voluntarily choose a monoculture that can force our choices in the future...

> We need to ensure we don't end up with environment as diverse as email where most people use Gmail Good luck making something that's both 1) the most convenient and 2) not centralized.

good luck? with that attitude you deserve shitty centralized systems that spy on you. decentralization and ease of use aren't contradictory anyway. remember bit torrent? used to be very popular, even among less technical users. great UX too. click a magnet link and you have your content in a flash.

the problem is that there isn't a multi-billion dollar business case for decentralized user systems. a lot of server/dc tech is both decentralized and distributed because it is a more robust architecture. again, the reason this doesn't extend to the consumer is because it give them too much control and clogs up the revenue stream.

this isn't a technical or usability problem, as you claim. this is 100% economic.

Re: The foundation of a more secure web: Google Trust Services

#134

Post by algesten »

tlrobinson wrote: post #48
algesten wrote: post #40

Earlier quoted context omitted.

I guess if NSA/FBI forces google to hand over the CA keys, they kan orchestrate undetectable MITM-attacks. I wonder why browser won't automatically store the fingerprint for every HTTPS-certificate it encounters and throw up a fuzz to the user if a certificate changes without any good reason?

It's opt-in by the site, but that's what public key pinning is: https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning

That's a bit different though, because you must pin an issuing key, not the actual cert.

Re: The foundation of a more secure web: Google Trust Services

#135

Post by algesten »

pepr wrote: post #62
algesten wrote: post #40

Earlier quoted context omitted.

I guess if NSA/FBI forces google to hand over the CA keys, they kan orchestrate undetectable MITM-attacks. I wonder why browser won't automatically store the fingerprint for every HTTPS-certificate it encounters and throw up a fuzz to the user if a certificate changes without any good reason?

Because the browser (or the user) has no way of knowing if the certificate changed for a good reason. Certificate pinning tries to tackle this at the CA level but it's not perfect (in a nutshell, browsers know that google.com can be signed only by a certain small subset of CAs).

The effort to prove a certificate is being changed for a good reason should be with the site owner, so I perhaps the standard could build in some sort of sign-by-previous-cert combined with mandatory information fields.

The certificate pinning of CA is not that useful.

So google rotate a lot of certs, but I bet 95% of the internet use one cert for one server until it expires. Google could fall in in line.

Re: The foundation of a more secure web: Google Trust Services

#137

Post by arca_vorago »

I have thought for a good while now that DNS is the primary weakness of the current incantation of the internet as the public knows it. I think perhaps we should ponder the benifits of replacing it, and using raw IP's more often.

In the meantime, DNSCurve would be a great start, vs the major issues I have found with DNSSec.

Re: The foundation of a more secure web: Google Trust Services

#138

Post by TorKlingberg »

zokier wrote: post #69
mixedCase wrote: post #56

Earlier quoted context omitted.

Most of us adjudicate too much value to TLDs. It's an artificially scarce resource and most people here learned about the Internet when these TLDs were even scarcer.

Well, personally I think that most of us adjudicate too little value to TLDs. The point of DNS is to be hierarchical instead of one flat space, so imho all legacy TLDs should have been immediately deprecated the day ccTLDs were introduced, and countries should have been endorsed to maintain second level hierarchy (somewhat like .uk had for some time). But of course that train left the station 30 years ago... in the c…

Many websites are not country specific. They started somewhere and are headquartered somewhere, but it is not something users should need to remember.

Re: The foundation of a more secure web: Google Trust Services

#139

Post by nerdponx »

tantalor wrote: post #129
arkitaip wrote: post #128

Earlier quoted context omitted.

What I am waiting for is a good shopping experience hosted by Google. Can for the life of my not understand why did still haven't done this because it would solve so many of their problems wrt ads and purchasing.

What? There's a big "shopping" tab at the top of every search results page.

But do you use it? Probably not. Is it usable, are the results good? Nope. Is it a good user experience? Not the few times I've tried it.

Re: The foundation of a more secure web: Google Trust Services

#140

Post by return0 »

aduffy wrote: post #65

You can now have a website secured by a certificate issued by a Google CA, hosted on Google web infrastructure, with a domain registered using Google Domains, resolved using Google Public DNS, going over Google Fiber, in Google Chrome on a Google Chromebook. Google has officially vertically integrated the Internet.

And monetized and paid for through google ads. It's your life, packaged.
Post reply on HN