Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Sci-Hub's TLS certificate has started failing

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 154 posts

Re: Tell HN: Sci-Hub's TLS certificate has started failing

#61

Post by solarkraft »

234213wefsdf wrote: post #46
dlgeek wrote: post #36

Earlier quoted context omitted.

https://social.technet.microsoft.com/wiki/contents/articles/... > If Microsoft, it its sole discretion, identifies a DV Server Authentication certificate is being used to promote malware or unwanted software, Microsoft will contact the responsible CA and request that it revoke the certificate. The CA must either revoke the certificate within a commercially-reasonable timeframe, or it must request an exception from Mi…

This is absolutely insane, and Microsoft really has no position to make these demands. Does McDonalds have the right to get your drivers licensed revoked? (Even if you say... use the drive thru to steal mcnuggets?) Hell no, and neither does microsoft.

Could MS not ultimately stop honoring said vendor's certificates?

Re: Tell HN: Sci-Hub's TLS certificate has started failing

#62

Post by lfam »

sillysaurus3 wrote: post #48
Rjevski wrote: post #24

It’s a sign of trouble, but I’m not sure it’s really “further” trouble, all it takes is for them to get a cert from Let’s Encrypt and call it a day. I’m surprised they weren’t using LE to begin with actually - since LE is available, why would you ever pay for another CA (excluding EV certificates)?

This is a much bigger deal than people are giving it credit for. At any point in history, have CAs revoked certs solely to censor a target website? Maybe the answer is yes. I don't know. But this is a rude wake-up call for me and everyone else who tried to force the world into this shape. We've all been shouting "You have to use TLS! It's fundamental security 101. If you're not using https, your site is probably brok…

It's true HTTPS traffic can be blocked (at least partially) by revoking certificates, but is this worse than the censorship opportunities offered by unauthenticated HTTP?

Whether the traffic is authenticated or not, ISPs block sites when instructed by government orders. And that is much harder to work around than a revoked TLS cert (although a revoked cert does mean "totally blocked" for almost all users).

These are not purely technical challenges, but rather political issues that must be addressed as such. We will always lose to our governments if we focus only on technical solutions to censorship.

I'd like to add that the USA government, for the most part, does not accept an absolute right to private communication. The possibility of ubiquitous end-to-end encrypted communications with tools like TLS and WhatsApp is not something we should take for granted. The USA matters here because we are the powerful nation with the strongest legal and cultural commitment to freedom of speech.

Re: Tell HN: Sci-Hub's TLS certificate has started failing

#63

Post by ethbro »

ams6110 wrote: post #54
sillysaurus3 wrote: post #48

Earlier quoted context omitted.

This is a much bigger deal than people are giving it credit for. At any point in history, have CAs revoked certs solely to censor a target website? Maybe the answer is yes. I don't know. But this is a rude wake-up call for me and everyone else who tried to force the world into this shape. We've all been shouting "You have to use TLS! It's fundamental security 101. If you're not using https, your site is probably brok…

Self-signed certificates, trust on first use (or verify out of band) like SSH, works around most of this

Correct me if I'm wrong, but the signed server-identifying cert is swapped in TLS before the connection is encrypted, no?

So it's not technically infeasible to have networking gear drop any connection which doesn't chain back to a government-approved root?

Re: Tell HN: Sci-Hub's TLS certificate has started failing

#64

Post by ethbro »

sillysaurus3 wrote: post #48
Rjevski wrote: post #24

It’s a sign of trouble, but I’m not sure it’s really “further” trouble, all it takes is for them to get a cert from Let’s Encrypt and call it a day. I’m surprised they weren’t using LE to begin with actually - since LE is available, why would you ever pay for another CA (excluding EV certificates)?

This is a much bigger deal than people are giving it credit for. At any point in history, have CAs revoked certs solely to censor a target website? Maybe the answer is yes. I don't know. But this is a rude wake-up call for me and everyone else who tried to force the world into this shape. We've all been shouting "You have to use TLS! It's fundamental security 101. If you're not using https, your site is probably brok…

> At any point in history, have CAs revoked certs solely to censor a target website?

Revoking certs from US CAs is probably the new DNS seizure, post- encryption and TLD expansion.

Although hopefully it'll die a quick death when they realize it's ineffective.

Re: Tell HN: Sci-Hub's TLS certificate has started failing

#65

Post by userbinator »

ethbro wrote: post #57
salawat wrote: post #55

This type of thing is my number one objection to Certificate Authorities. In fact, it's my objection to computation illiteracy being acceptable in general amongst users. Devs and agencies cannot be trusted not to screw with things. If the average Joe cannot understand what is going on behind the curtains, they aren't free. Freedom is a scary thing to many groups, and unfortunately, more and more we are seeing the pen…

Well said. I blame 2nd coming Jobs (iMac and iPod era) and same period Microsoft for a lot of this as they competed with each other. Usability became more important than flexibility. And intuitive operation prioritized over ease of learning. There's a lot to be said for a harder to use computer with a learning curve, but which affords you more power to be a creator instead of a consumer at the end of the curve. I'd g…

More importantly, the ability to write and run your own code easily, of which learning is only part of the process. From that perspective, Apple was closed from almost the beginning, while the PC and various other micros of the time (ZX, C64, etc.) started out open.

Re: Tell HN: Sci-Hub's TLS certificate has started failing

#66

Post by userbinator »

ethbro wrote: post #63
ams6110 wrote: post #54

Earlier quoted context omitted.

Self-signed certificates, trust on first use (or verify out of band) like SSH, works around most of this

Correct me if I'm wrong, but the signed server-identifying cert is swapped in TLS before the connection is encrypted, no? So it's not technically infeasible to have networking gear drop any connection which doesn't chain back to a government-approved root?

So it's not technically infeasible to have networking gear drop any connection which doesn't chain back to a government-approved root?

Yse, and that is a very scary thought. China is doing something similar already.

Re: Tell HN: Sci-Hub's TLS certificate has started failing

#67

Post by x0x0 »

userbinator wrote: post #40
06983234 wrote: post #2

This is exactly what I said would happen when Google started making all of us use HTTPS.

You're not the only one. I hypothesised about this before in previous SciHub discussions, and SciHub isn't the only site that is/will be affected. Security is the ostensible benefit, and it's the one they advertise the most; easier censorship and centralised access control is the other---something which a lot of the pro-(traditional)-HTTPS advocates don't advertise. Make HTTPS mandatory (so no more HTTP), make it nea…

Let's not pretend the real reason google isn't so gung-ho about https everywhere is to prevent the ISPs from muscling into their businesses:

* ads on page

* seeing all internet traffic to enhance targeting

Re: Tell HN: Sci-Hub's TLS certificate has started failing

#68

Post by userbinator »

0x00000000 wrote: post #13
tscs37 wrote: post #9

Earlier quoted context omitted.

You can always manually trust certificates via various means, it's the basis for almost any corporate network, most browsers also offer a simply dialog to bypass certificate warnings.

Browsers seem to be moving towards making it harder to bypass, which is probably a good thing for the average user. I wouldn't be surprised to see the ability to ignore https errors (or access http sites at all) locked behind a developer setting or something.

As a user, it's hard to bypass, but as a developer, it is literally easier to "crack" the browser by patching the jump/value to always go to "cert is good" than try to find and make the corresponding changes in the source and then figure out how to recompile everything else identically. I'm not sure what to think of that...

Re: Tell HN: Sci-Hub's TLS certificate has started failing

#69

Post by [deleted] »

sillysaurus3 wrote: post #48
Rjevski wrote: post #24

It’s a sign of trouble, but I’m not sure it’s really “further” trouble, all it takes is for them to get a cert from Let’s Encrypt and call it a day. I’m surprised they weren’t using LE to begin with actually - since LE is available, why would you ever pay for another CA (excluding EV certificates)?

This is a much bigger deal than people are giving it credit for. At any point in history, have CAs revoked certs solely to censor a target website? Maybe the answer is yes. I don't know. But this is a rude wake-up call for me and everyone else who tried to force the world into this shape. We've all been shouting "You have to use TLS! It's fundamental security 101. If you're not using https, your site is probably brok…

[deleted]
Post reply on HN