Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linus Torvalds Interview for LinuxFR

linuxfr.org

Post reply on HN
Print view View original

11–20 of 57 posts

Re: Linus Torvalds Interview for LinuxFR

#11

Post by [deleted] »

pmjordan wrote: post #7
smanek wrote: post #5

Earlier quoted context omitted.

Off-topic, but does anyone know why browsers go crazy about self signed certs? It's not as good as one signed by an ostensibly trusted CA, but it's strictly better than plain HTTP (no sniffing, harder MITM, etc) - so why not present it to the user the same way that plain HTTP is? The conspiracy theorist in me wonders if trusted CAs 'lobby' browser vendors to make it so?

Self-signed certificates don't prevent MITM attacks on connecting unless you've transmitted the certificate securely out-of-band and installed it in the client's browser. (which practically never happens with sites on the open internet) They only prevent tampering with the connection once it's established. The browser should jump up and down when encountering such a certificate as it's exactly how an attempted MITM a…

[deleted]

Re: Linus Torvalds Interview for LinuxFR

#12

Post by smanek »

wladimir wrote: post #9
smanek wrote: post #8

Earlier quoted context omitted.

Any attack I can think of that exploits that fact would work at least as easily on plain HTTP. And there are a large class of attacks that work on plain HTTP but not with a self signed cert. Can you think of any counter examples? (Note: I'm a security noob - so I'm asking out of sincere curiosity).

I don't think there is any doubt that even with a self-signed certificate, HTTPS is more secure than HTTP. At the least, it makes interception/sniffing/modification a bit harder. Security, after all, is about making attacks more difficult and costly. Still there is good reason that browsers rub it in the users face when a site tries to use a self-signed certificate. The user has to be really really sure that this is…

Maybe I'm missing your answer there ... You just say:

Still there is good reason that browsers rub it in the users face when a site tries to use a self-signed certificate

but I don't see where you say what that good reason is.

If a self-signed cert is more secure than plain HTTP, why make a self-signed cert more painful to use than plain HTTP?

Re: Linus Torvalds Interview for LinuxFR

#13

Post by wladimir »

smanek wrote: post #12
wladimir wrote: post #9

Earlier quoted context omitted.

I don't think there is any doubt that even with a self-signed certificate, HTTPS is more secure than HTTP. At the least, it makes interception/sniffing/modification a bit harder. Security, after all, is about making attacks more difficult and costly. Still there is good reason that browsers rub it in the users face when a site tries to use a self-signed certificate. The user has to be really really sure that this is…

Maybe I'm missing your answer there ... You just say: Still there is good reason that browsers rub it in the users face when a site tries to use a self-signed certificate but I don't see where you say what that good reason is. If a self-signed cert is more secure than plain HTTP, why make a self-signed cert more painful to use than plain HTTP?

Because with HTTP, there is no assumption of security at the side of the user, or at least there shouldn't be. With HTTPS (and the "lock symbol") there is.

The people that really know what they're doing can click through the warnings and still do what they want. But casual users that assume https=safe have the chance to leave.

I'm all for deprecating HTTP the same way they did with TELNET, and warning the user for every HTTP site they go to, but that's a wholly different discussion :)

Re: Linus Torvalds Interview for LinuxFR

#15

Post by codeup »

smanek wrote: post #5
tbassetto wrote: post #4

Almost all browsers will show a warning about the certificate… Link without https : http://linuxfr.org/nodes/85904/comments/1230981

Off-topic, but does anyone know why browsers go crazy about self signed certs? It's not as good as one signed by an ostensibly trusted CA, but it's strictly better than plain HTTP (no sniffing, harder MITM, etc) - so why not present it to the user the same way that plain HTTP is? The conspiracy theorist in me wonders if trusted CAs 'lobby' browser vendors to make it so?

The CA system is broken and browser vendors try to deal with it. Deal with it = trade off between security and (in)convenience.

Re: Linus Torvalds Interview for LinuxFR

#16

Post by ilcavero »

wladimir wrote: post #9
smanek wrote: post #8

Earlier quoted context omitted.

Any attack I can think of that exploits that fact would work at least as easily on plain HTTP. And there are a large class of attacks that work on plain HTTP but not with a self signed cert. Can you think of any counter examples? (Note: I'm a security noob - so I'm asking out of sincere curiosity).

I don't think there is any doubt that even with a self-signed certificate, HTTPS is more secure than HTTP. At the least, it makes interception/sniffing/modification a bit harder. Security, after all, is about making attacks more difficult and costly. Still there is good reason that browsers rub it in the users face when a site tries to use a self-signed certificate. The user has to be really really sure that this is…

I think the problem is with firefox warning annoyance, in chrome you get a good short explanation of what's going on and a button to continue (plus a graphical indication afterward that https is somehow not working), on firefox on the other hand you get a warning with a hidden section where there is a button to open a pop-up window that will then allow you to download/view the certificate and press "confirm security exception".

In summary, firefox exaggerated with their warning, I'm wondering if it is possible to do an addon to fix this.

Re: Linus Torvalds Interview for LinuxFR

#17

Post by bruce511 »

I think Linus's pragmatism has a lot to do with Linux's success. He's out to make Linux the best it can be, and he's not worried about what MS is doing or what BSD thinks or whatever. He doesn't have the political agenda of the FSF or the commercial agenda of say Apple or Sun. Hardware companies can open, or not open, their hardware - developers can build open, or closed, source programs on Linux.

His approach to licenses is the same - he uses what works for him, and lets others decide for themselves what works for them.

It makes Linux attractive as a platform at all levels because you never feel like you're making some grand statement, or locking into someone's master plan. I have Linux servers in the office, but also Windows desktops. I program code for embedded devices (running Linux). We use the right tool for the job, and if a better tool comes along we can switch. We're not married to the computers, we just use them.

To some extent this makes the whole "Linux on the desktop" issue a non-issue. Maybe it'll be on the desktop one day. Maybe it won't be. Either way it doesn't seem like this matters much to Linus - as he said Linux competes with itself.

I like pragmatism. It gets stuff done.

Re: Linus Torvalds Interview for LinuxFR

#19

Post by vladd »

smanek wrote: post #10
pmjordan wrote: post #7

Earlier quoted context omitted.

Self-signed certificates don't prevent MITM attacks on connecting unless you've transmitted the certificate securely out-of-band and installed it in the client's browser. (which practically never happens with sites on the open internet) They only prevent tampering with the connection once it's established. The browser should jump up and down when encountering such a certificate as it's exactly how an attempted MITM a…

Granted, it doesn't provide as much protection as a cert signed by a trusted CA - but it's still far more protection than plain HTTP, right? e.g, Firesheep wouldn't work I don't know if browsers do this, but in principle they could even notify the user on certificate change, so the MITM would have to be on the first connection to a site.

Introducing a "third state" for the SSL indicator, usability-wise, is very difficult. A lot of browser users don't understand SSL, and those that do have a binary understanding of the protocol: it can be used to either confirm or refute the identity of a website. It's very difficult to implement a UI for the regular users that says: "this might be a MITM attack since I cannot confirm the identity of the site but at least I can confirm that it's the same with the one that you connected with the first time".

Re: Linus Torvalds Interview for LinuxFR

#20

Post by MatthewPhillips »

smanek wrote: post #10
pmjordan wrote: post #7

Earlier quoted context omitted.

Self-signed certificates don't prevent MITM attacks on connecting unless you've transmitted the certificate securely out-of-band and installed it in the client's browser. (which practically never happens with sites on the open internet) They only prevent tampering with the connection once it's established. The browser should jump up and down when encountering such a certificate as it's exactly how an attempted MITM a…

Granted, it doesn't provide as much protection as a cert signed by a trusted CA - but it's still far more protection than plain HTTP, right? e.g, Firesheep wouldn't work I don't know if browsers do this, but in principle they could even notify the user on certificate change, so the MITM would have to be on the first connection to a site.

It's a false sense of security, which is why they put the warning. You have no sense of security when visiting a plain http site.
Post reply on HN