Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How not to run a CA

blog.koehntopp.info

Post reply on HN
Print view View original

151–160 of 255 posts

Re: How not to run a CA

#151

Post by cup-of-tea »

dpark wrote: post #58
cup-of-tea wrote: post #44

Earlier quoted context omitted.

If you reject the web of trust then you're saying you trust nobody (except yourself). Do you really not know anybody you trust to verify identities on your behalf? (That's a trick question because you trust the CAs).

I specifically said that I do trust a set of people. Do you imagine that my small set of trusted people will personally vouch for the authenticity of millions of certs so that I can use the web? Of course not. You imagine instead that I'll trust the next set of people and so on, and that all this transitive trust will let me trust my bank's website. But I don't trust all those random people, which leads to a clear re…

But you trust the CAs right now. If we used a web of trust system, you could still trust those CAs and nobody else. That's your model that you say isn't broken. You can be happy with that. I'll be happy with trusting people that I trust.

Re: How not to run a CA

#152

Post by teraflop »

Karunamon wrote: post #129
cortesoft wrote: post #121

Earlier quoted context omitted.

Aren't the audits what allow us to find out about the failures, and revoke their ability to be a CA?

How many of the most recent failures have come to light as a result of a failed audit, and how many were due to a post-audit, outrage-generating violation of basic best practice and common sense?

The whole point of auditing is to detect problems before they become big, embarrassing, messy failures that put users at risk.

If you hang out on mozilla.dev.security.policy for a while, you'll see plenty of examples of audits exposing weaknesses or sloppiness on the part of CAs, and receiving the resulting pushback from browser vendors. Here's the most recent example I've found: https://groups.google.com/forum/?fromgroups=#!topic/mozilla....

Re: How not to run a CA

#153

Post by teraflop »

thriftwy wrote: post #141
TheDong wrote: post #138

Earlier quoted context omitted.

ssh is, by default, Trust on First Use which is a significantly different model than a Trusted Thirdparty (CAs). There are some well known trade-offs, namely that having everyone manually verify fingerprints on initial connect and again on any server change is a large burden. I don't particularly want to have to go into my bank's local office and verify in person the fingerprint is correct each time they need to rota…

I think it works much better for contacts. You have to verify contact once and then you are assured that it's still the same person.

> You have to verify contact once

Only if users never replace their keys, which puts them at significant risk in the event of a key compromise.

Re: How not to run a CA

#154

Post by 0x0 »

mkhalil wrote: post #61

In related news, Trustico's site is down apparently due to users being able to run commands as root on their webserver. I wonder if this was used to extract some private keys? https://twitter.com/svblxyz/status/969220402768736258 https://twitter.com/Manawyrm/status/969230542578348033

Should count as probable cause for revoking the remaining 27k certificates then, no? It's not unreasonable to think someone has been exploiting this for years, siphoning any private key passing through?

Re: How not to run a CA

#155

Post by cup-of-tea »

dpark wrote: post #76
cup-of-tea wrote: post #69

Earlier quoted context omitted.

You wouldn't trust a chain that long with something that sensitive. WOT gives you the ability to have different tiers of trust. If you verified the identity yourself then you can trust it completely. If you accept people verifiying identities on your behalf then you can choose exactly who you trust (ie. not everyone). It not only makes the delegation explicit, it gives you much more fine grained control about how muc…

Yeah, web of trust gives me the option to manually decide, every time, if the chain(s) of trust looks "good enough" for me to trust the other party. There are two problems with this: 1. This is a ton of work and a lot of guesswork even for educated individuals. I end up looking at either explicit chains of trust (I trust Bob and he trusts Alice and she says that this is definitely my bank's website) or some random va…

> Laypersons are completely fucked. No way my grandmother can reasonably decide who to trust this way.

Can your grandmother trust you? Or maybe you're not prepared to keep her secure so you just tell her "trust Google, grandma".

Re: How not to run a CA

#156

Post by cesarb »

0x0 wrote: post #154
mkhalil wrote: post #61

In related news, Trustico's site is down apparently due to users being able to run commands as root on their webserver. I wonder if this was used to extract some private keys? https://twitter.com/svblxyz/status/969220402768736258 https://twitter.com/Manawyrm/status/969230542578348033

Should count as probable cause for revoking the remaining 27k certificates then, no? It's not unreasonable to think someone has been exploiting this for years, siphoning any private key passing through?

The remaining 27k certificates are probably the ones which were generated on and which never left the customer's premises. The only thing which could be siphoned in these cases is the CSR, which is harmless (it contains essentially the same info as the certificate, which is public).

Re: How not to run a CA

#157

Post by aidenn0 »

0xbadcafebee wrote: post #52

> TL;DR: Forget your EV or other certs. Just run “Let’s Encrypt”. It gets you a cert, it’s fresh, and it does not make any difference whatsoever. At least not any you or anyone else can check for, or cares for. Let's Encrypt shut down their new test interface because of a security flaw they found. If this was in a production service, this would have been about as bad of a security flaw as is possible in a PKI system.…

At least with LE we're not paying to have our data compromised :)

Re: How not to run a CA

#158

Post by dpark »

cup-of-tea wrote: post #155
dpark wrote: post #76

Earlier quoted context omitted.

Yeah, web of trust gives me the option to manually decide, every time, if the chain(s) of trust looks "good enough" for me to trust the other party. There are two problems with this: 1. This is a ton of work and a lot of guesswork even for educated individuals. I end up looking at either explicit chains of trust (I trust Bob and he trusts Alice and she says that this is definitely my bank's website) or some random va…

> Laypersons are completely fucked. No way my grandmother can reasonably decide who to trust this way. Can your grandmother trust you? Or maybe you're not prepared to keep her secure so you just tell her "trust Google, grandma".

No, my grandmother cannot trust me to verify every site she might want to visit. How am I supposed to know if random blog is legit? Or for that matter random bank?

The fact that I have to answer this tells me that you haven't though through the implications of web of trust very far.

Re: How not to run a CA

#159

Post by dpark »

cup-of-tea wrote: post #151
dpark wrote: post #58

Earlier quoted context omitted.

I specifically said that I do trust a set of people. Do you imagine that my small set of trusted people will personally vouch for the authenticity of millions of certs so that I can use the web? Of course not. You imagine instead that I'll trust the next set of people and so on, and that all this transitive trust will let me trust my bank's website. But I don't trust all those random people, which leads to a clear re…

But you trust the CAs right now. If we used a web of trust system, you could still trust those CAs and nobody else. That's your model that you say isn't broken. You can be happy with that. I'll be happy with trusting people that I trust.

You propose a world where CAs still exist and all the infrastructure to support them exists, and realistically everyone continues to rely on them. But in parallel, everyone will build this web of trust system so that you can prefer it when it's convenient. That seems real plausible.

Re: How not to run a CA

#160

Post by inetknght »

dredmorbius wrote: post #126
inetknght wrote: post #50

Earlier quoted context omitted.

> HTTP is generally secure This statement is wholly incorrect. HTTP is not generally secure. > for publishing When I publish something I do not intend for third parties to interfere with the delivery of what I publish. > and has the added advantage of being cacheable by proxies If you trust your proxy, you can still have cached data at your proxy. If you don't trust your proxy, then why are you proxying through it?

HTTP plus a trusted hash would provide an integrity measure of the content of a page, and enable hashing. It would not prevent anyone from examining that content in flight, or altering it. It would allow any such alteration to be identified . It is possible to offer various levels of assurance on unencrypted communications. Mind: I'm describing a possible world, not the one most of us happen to live in. Unless, say,…

You cannot have a "trusted hash" if you cannot trust the delivery mechanism (unencrypted and unauthenticated TCP).

The content of the delivered payload (your blog and your "trusted hash") can be altered by anyone in transit.

When you take unencrypted and unauthenticated TCP and upgrade to encrypted and authenticated TLS, only then can you begin to have trust.

Post reply on HN