Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How not to run a CA

blog.koehntopp.info

Post reply on HN
Print view View original

81–90 of 255 posts

Re: How not to run a CA

#81

Post by u801e »

dpark wrote: post #76
cup-of-tea wrote: post #69

Earlier quoted context omitted.

You wouldn't trust a chain that long with something that sensitive. WOT gives you the ability to have different tiers of trust. If you verified the identity yourself then you can trust it completely. If you accept people verifiying identities on your behalf then you can choose exactly who you trust (ie. not everyone). It not only makes the delegation explicit, it gives you much more fine grained control about how muc…

Yeah, web of trust gives me the option to manually decide, every time, if the chain(s) of trust looks "good enough" for me to trust the other party. There are two problems with this: 1. This is a ton of work and a lot of guesswork even for educated individuals. I end up looking at either explicit chains of trust (I trust Bob and he trusts Alice and she says that this is definitely my bank's website) or some random va…

> I guarantee you a month later Google and Apple and Microsoft will become the de facto CAs

Except that none of those companies bother verifying one's identity if you're not actually paying for their services.

> and see if one of them vouches for their banking website.

In that scenario, could I not just verify the bank's public key when I'm physically in one of their branch locations while opening an account? They could also verify my public key at the same time. That would allow for a direct line of trust. The same could apply to any company one deals with.

Re: How not to run a CA

#82

Post by discreditable »

peterwwillis wrote: post #56
codebeaker wrote: post #24

Earlier quoted context omitted.

They're not verifying your identity, just that you control the hardware running the domain that you want to generate a certificate for.

Correction : that you can control the IP space advertised to Let's Encrypt. A BGP exploit would result in getting valid certs for someone else's domain/host. It's almost trivial to exploit BGP, which is why PKI is so important... so it should actually be incredibly difficult to get a cert.

If someone is hijacking BGP to MITM the world, how are the old methods any better?

Re: How not to run a CA

#83

Post by kevin_thibedeau »

blattimwind wrote: post #53
kasperni wrote: post #13

They have a tool that allows you create a private key + CSR https://www.trustico.com/ssltools/create/csr-pem/create-a-ne... Apparently they decided to keep a copy of the private key. Edit: Looks like they are having problems atm. A copy can be found at https://web.archive.org/web/20180217071027/https://www.trust...

Up until a few years ago there was a tag which embedded a x509 CSR generator into a regular HTML form. The private key was generated by the browser(1) and was completely inaccessible to the site or any JS running on it. That's the proper way to generate certificates in browsers, but it's been removed since and was never supported in IE. StartSSL used it, for example, but also allowed you to hand them a CSR of your ow…

It can't be that hard to whip up a cross platform Qt app that streamlines the keygen and CSR process in a user friendly fashion. Maybe throw in some dodgy key escrow service for the daring. Why does everything have to be done over the web.

Re: How not to run a CA

#84

Post by kbsletten »

devit wrote: post #78

Browsers need to remove all CAs except Let's Encrypt. CAs have proven again and again to be ridiculously insecure, and the problem is that there is no penalty for their mistakes. So just remove them all, after a warning period: Let's Encrypt is enough. Or if they want to stay in business and be trusted by browsers, then require them to put up at least $100k in cash in escrow for each certificate they sign, which is f…

I'm not sure that's as good an idea as you think. Even LE has designed ACME to ideally be replicated elsewhere. The big problem with having only one CA is that if they get compromised or go down, that's the entire internet. For good reason, it's not like you can launch a CA in a day, so we will always need a few horses in this race. Culling the herd isn't a bad idea, but without some diversity any issue could be catastrophic.

Re: How not to run a CA

#85

Post by greenhouse_gas »

zaarn wrote: post #62
cup-of-tea wrote: post #44

Earlier quoted context omitted.

If you reject the web of trust then you're saying you trust nobody (except yourself). Do you really not know anybody you trust to verify identities on your behalf? (That's a trick question because you trust the CAs).

There is levels of trust. While I maybe trust someone to be a real person after I've met them in real life and ate their spaghetti to give me back the 10$ they borrowed, I wouldn't trust them to verify the identity of the IRS for me. The current solution is that we have some third parties which follow strict rules defined by themselves and browser vendors. Everyone involved has a very good incentive to remain trustwo…

>They're switching to TOFU instead, the first time you see a key it's trustworthy, similar to SSH.

Which is horrible unless your first connection to a server is trustworthy or you have an out-of-band way to verify keys (which is why it works in SSH, and can't work on the web).

Re: How not to run a CA

#86

Post by Dayshine »

devit wrote: post #78

Browsers need to remove all CAs except Let's Encrypt. CAs have proven again and again to be ridiculously insecure, and the problem is that there is no penalty for their mistakes. So just remove them all, after a warning period: Let's Encrypt is enough. Or if they want to stay in business and be trusted by browsers, then require them to put up at least $100k in cash in escrow for each certificate they sign, which is f…

Yeah, Let's Encrypt doesn't support OV or EV certs...

Re: How not to run a CA

#87

Post by jnbiche »

devit wrote: post #78

Browsers need to remove all CAs except Let's Encrypt. CAs have proven again and again to be ridiculously insecure, and the problem is that there is no penalty for their mistakes. So just remove them all, after a warning period: Let's Encrypt is enough. Or if they want to stay in business and be trusted by browsers, then require them to put up at least $100k in cash in escrow for each certificate they sign, which is f…

> Browsers need to remove all CAs except Let's Encrypt.

No. I love Let's Encrypt, but we can't put all our eggs in a single basket like that.

Now, if we could somehow foster multiple non-profit organizations like Let's Encrypt, but run under the aegis of different boards and sponsors, I'd be 100% for this idea.

It's very odd that companies for whom CAs business is quite literally a money printing operation can't be bothered to do the relatively minimal maintenance and care required for a trustworthy CA. A bizarre and unexpected failure of the market.

Re: How not to run a CA

#88

Post by tialaramex »

blattimwind wrote: post #53
kasperni wrote: post #13

They have a tool that allows you create a private key + CSR https://www.trustico.com/ssltools/create/csr-pem/create-a-ne... Apparently they decided to keep a copy of the private key. Edit: Looks like they are having problems atm. A copy can be found at https://web.archive.org/web/20180217071027/https://www.trust...

Up until a few years ago there was a tag which embedded a x509 CSR generator into a regular HTML form. The private key was generated by the browser(1) and was completely inaccessible to the site or any JS running on it. That's the proper way to generate certificates in browsers, but it's been removed since and was never supported in IE. StartSSL used it, for example, but also allowed you to hand them a CSR of your ow…

You say "they of course ignored almost everything in the CSR apart from the public key" but it turns out they went a bit further than that, they also ignored the signature on the CSR.

So you could put some other public key in there, add a bogus signature that wouldn't verify and they'd issue certificates for a key you never even controlled.

The bad security implications for that scenario are a bit subtle, and situational, but CAs are supposed to be checking that the CSR is properly signed, that's only a long way down the list because StartCom/ WoSign had so many other serious problems.

Re: How not to run a CA

#89

Post by d0lph »

pjc50 wrote: post #66
sphix0r wrote: post #10

Ironically his blog isn't available on https. Would be time that browers mark http sites' address bar as "Not secure" in orange. It's either secure or it isn't. Fun fact; Europe's ePrivacy law is coming next year which enforces all communication to be secure.

> Europe's ePrivacy law is coming next year which enforces all communication to be secure. Link to Directive please? (The reason I ask is that news reporting on EU law in English is extremely unreliable, and it's best to go to primary sources)

Even local reporting on new laws is not great, somewhat recently was Feinstein's gun law, not a fan of it, but there was so much misinformation flying around, making it seem much worse than it was. Which in turn detracted from legitimate criticism.

Re: How not to run a CA

#90

Post by zokier »

> proving that Trustico has knowledge of all their customers private keys, keeping copies of them, which proves that they never knew how to run a Certficate Authority business in the first place

Well, they also weren't actually running a CA business either.

Post reply on HN