Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Netgear Signed TLS Cert Private Key Disclosure

gist.github.com

Post reply on HN
Print view View original

61–70 of 158 posts

Re: Netgear Signed TLS Cert Private Key Disclosure

#61

Post by CiPHPerCoder »

JshWright wrote: post #59
ryanlol wrote: post #48

Earlier quoted context omitted.

It should be noted that it’s essentially never the people who find bugs arguing for “responsible disclosure”. It sure is easy to tell others what to do with their work product when you have zero stake in the game. There exists a really easy solution to the purported problem of full disclosure, vendors could just offer significant enough financial compensation for non-disclosure.

I think the millions of people with Netgear equipment deployed have some "stake in the game". How does non-disclosure benefit them?

'ryanlol is suggesting that if companies view "full disclosure" as a problem, the solution is (in my words) bribery.

I don't think "benefiting the end users" is even present in that equation.

Re: Netgear Signed TLS Cert Private Key Disclosure

#62

Post by zzzcpan »

josteink wrote: post #58

To all the people shitting on Netgear and security in this thread, just how do you propose one deliver a secure network appliance to end customers which they can deploy on their network? And which is user-accessible to common users in modern browsers rejecting everything not touched by a proper CA? Really. Please educate the world with your ingenious insight. I’ll be waiting. The unavoidable truth is: You have to stu…

On local networks TLS doesn't make things more secure, maybe even less in some scenarios given all the obtaining of certificates over public internet and leaking info to the public internet. So sane thing to do would be plain http. But really, browsers should stop the bullshit with https "security" and accept ssh-like behavior at least for local networks.

Re: Netgear Signed TLS Cert Private Key Disclosure

#63

Post by JshWright »

gdm85 wrote: post #19
regecks wrote: post #2

6 days is nowhere near a justifiable timeframe for full disclosure. Even if you disagree with that, you should have first reported Key Compromises to Entrust and Comodo before publicly posting the private keys. They are bound by BRs and their own CPS to revoke certificates such as this one - and they would have done so promptly. This is not what you should do as a security researcher - delete the gist until the CAs h…

There is another reason why responsible disclosure would have been better (and less short-sighted): vendor might make an internal audit, find root cause and invalidate a bunch of certificates at once (think about similarly leaked certificates due to a bug in some deployment tool). Now it's an open race with the bad guys, and surely a lot of them all at once; hardly an advantageous scenario for end users.

That's an awfully big (and awfully optimistic) "might" in your first paragraph there...

Re: Netgear Signed TLS Cert Private Key Disclosure

#64

Post by pjc50 »

josteink wrote: post #58

To all the people shitting on Netgear and security in this thread, just how do you propose one deliver a secure network appliance to end customers which they can deploy on their network? And which is user-accessible to common users in modern browsers rejecting everything not touched by a proper CA? Really. Please educate the world with your ingenious insight. I’ll be waiting. The unavoidable truth is: You have to stu…

Define "secure". If you've "stuffed the key in there" in such a way that other people can get it out again, and it works across all routers of that model, then it's possible for an active attacker on your network to MITM your connection to your router. So it's slightly more secure than cleartext but not much; about the same as a random self-signed certificate.

It is definitely a hard problem because there's no easy way to authenticate the router to the client, but on the other hand I'm not sure how important all of this is when it's on a local link anyway.

A "best possible practice" solution would be to have the routers issued with individual certificates at factory programming time, and provide a rollover mechanism through the admin UI.

Re: Netgear Signed TLS Cert Private Key Disclosure

#65

Post by mdszy »

shock wrote: post #53
bottled_poe wrote: post #37

Netgear has reliably demonstrated to me over more than 10 years that they are incapable of delivering secure products of an acceptable quality. I actively avoid this brand like the plague.

I have posted this in another thread, but I am posting it again because more people need to be aware of Netgear's practices: I recently bought a couple of Netgear Managed Switches (for Business)⁰ and in their datasheet they list "Local-only management" as a feature. Only after they arrived we discovered that you only get limited functionality in the Local-only management mode, you have to register the switches to you…

>Netgear Managed Switches (for Business)⁰

>⓪ - the switches are Netgear GS-108Tv3

are we not allowed to use any sane method of doing footnotes? Who does this? Why would you even use footnotes in internet comments other than to specifically screw over anyone who uses a screen reader?

Re: Netgear Signed TLS Cert Private Key Disclosure

#66

Post by oarsinsync »

josteink wrote: post #58

To all the people shitting on Netgear and security in this thread, just how do you propose one deliver a secure network appliance to end customers which they can deploy on their network? And which is user-accessible to common users in modern browsers rejecting everything not touched by a proper CA? Really. Please educate the world with your ingenious insight. I’ll be waiting. The unavoidable truth is: You have to stu…

This was answered on the Gist in a comment[0] linking to a tweet[1]:

Things to do instead of shipping TLS certs and static private keys to consumer-grade routers you sell by the thousand:

Generate a unique keypair per device.

Use this keypair to communicate upstream, in a similar fashion to CloudFlare's Keyless SSL.

This keypair you generate on the device would need to be preloaded at the factory, unique per device, and the public key would need to be stored in a database.

When a TLS handshake comes in, you verify the entire request is signed by that keypair before signing it.

Delegated online signing for a TLS handshake isn't even in the top 10 engineering challenges for cryptography in the 2020s.

Oh, and, if you don't have connectivity to upstream and your need users to connect to configure something?

Fallback to HTTP reachable via port 80 on the private IP for the server.

[0] https://gist.github.com/nstarke/a611a19aab433555e91c656fe1f0...

[1] https://twitter.com/CiPHPerCoder/status/1219228544548720640

Re: Netgear Signed TLS Cert Private Key Disclosure

#67

Post by bmn__ »

mdszy wrote: post #65
shock wrote: post #53

Earlier quoted context omitted.

I have posted this in another thread, but I am posting it again because more people need to be aware of Netgear's practices: I recently bought a couple of Netgear Managed Switches (for Business)⁰ and in their datasheet they list "Local-only management" as a feature. Only after they arrived we discovered that you only get limited functionality in the Local-only management mode, you have to register the switches to you…

>Netgear Managed Switches (for Business)⁰ >⓪ - the switches are Netgear GS-108Tv3 are we not allowed to use any sane method of doing footnotes? Who does this? Why would you even use footnotes in internet comments other than to specifically screw over anyone who uses a screen reader?

> are we not allowed to use any sane method of doing footnotes?

There is no markup on HN for footnotes. https://news.ycombinator.com/formatdoc

> Who does this?

Blame the people running the site, this is just a small inconvenience compared with other lack of features.

> screw over anyone who uses a screen reader?

As GP's footnote is plain text – not markup – there is no problem with screen readers (or any user-agent, really). Curious why you would think otherwise.

Re: Netgear Signed TLS Cert Private Key Disclosure

#68

Post by franga2000 »

ajsnigrutin wrote: post #60
vbezhenar wrote: post #31

Earlier quoted context omitted.

Yeah, that's why I think that movement to HTTPS everywhere must at least exclude private IP addresses. While it's expected to have HTTPS on public resources, what happens in my local network is my business and should not be considered insecure.

The problem is, that someone setting up a public wifi (in a restaurant for example), will be vulnerable to sniffing attacks (if they don't know what they're doing).

So get a cert before setting up wifi. This is not a hard problem. 1. Connect to AP with random key from the box 2. Open admin panel over HTTP 3. Follow instructions to get Internet access 4. As soon as it has a connection, the router obtains a cert and redirects you to HTTPS 5. Now you can make all your poor security decisions

Re: Netgear Signed TLS Cert Private Key Disclosure

#69

Post by mdszy »

bmn__ wrote: post #67
mdszy wrote: post #65

Earlier quoted context omitted.

>Netgear Managed Switches (for Business)⁰ >⓪ - the switches are Netgear GS-108Tv3 are we not allowed to use any sane method of doing footnotes? Who does this? Why would you even use footnotes in internet comments other than to specifically screw over anyone who uses a screen reader?

> are we not allowed to use any sane method of doing footnotes? There is no markup on HN for footnotes. https://news.ycombinator.com/formatdoc > Who does this? Blame the people running the site, this is just a small inconvenience compared with other lack of features. > screw over anyone who uses a screen reader? As GP's footnote is plain text – not markup – there is no problem with screen readers (or any user-agent,…

Because it interrupts the flow completely when they could have just written the model number along inside of the already-used parens like a normal human being. With a screen reader, it'll get to the superscript 0, read that out, and then won't be able to read the actual footnote content until the very end. Can't jump around like our eyes can. "⓪" isn't even read by a screen reader (at least not narrator on windows 10). Footnotes in internet comments are useless and unnecessary anyway.
Post reply on HN