Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla SSL policy bad for the Web

cs.uml.edu

Post reply on HN
Print view View original

51–60 of 89 posts

Re: Mozilla SSL policy bad for the Web

#51

Post by grhino »

aristus wrote: post #19
grhino wrote: post #8

What's encryption without authentication? Encryption ensures that only the entity you are sending the message to can read it. If you can't be sure of the entity you are sending the message to, then what's the point of encrypting it in the first place? Why does the article pick out Mozilla in particular? Are they suggesting that FireFox makes it overly complex to ignore the warning and continue on?

Encryption without authentication is just that: encryption. The point of encryption is to make sure no one else is listening OR modifying the data in transit. Like, say, your cash-starved ISP, or the government.

Without authentication, it could be your cash-starved ISP, or the government, which is generating a self-signed certificate.

Re: Mozilla SSL policy bad for the Web

#52

Post by [deleted] »

huhtenberg wrote: post #30
axod wrote: post #22

Earlier quoted context omitted.

Regardless, it's still better than straight HTTP. HTTP < Encrypted HTTP < Encrypted,signed HTTP

Actually, no. For all practical intents and purposes encryption w/o authentication is as good as no encryption. Unauthenticated encryption is 'better' than a plaintext in just one thing - it protects against passive snooping. Anyone willing to splice the connection will have full access to all your plaintext data and you won't even know about it. As such it's nothing more than an equivalent of reversible traffic obfu…

[deleted]

Re: Mozilla SSL policy bad for the Web

#53

Post by fendale »

tptacek wrote: post #31

Unbelievable. I've been poking about here for like 6 months now. You are all very smart people. Why is this so hard to understand? If you do not have a valid certificate signed by a CA, SSL is not providing any security . Yes, the warning you get when you visit a site with an invalid cert is much scarier than what you see if you visit an unencrypted site. But it's the sites that use encryption that users care about,…

I don't fully agree with what you are saying. A self signed certificate DOES provide 100% cryptographic security, in that nobody sniffing on the the wire, or whatever open wi-fi I happen to be using can see my data.

Securing the connection from 'spies' is only one part of an general SSL certificates function - the other is proving the identity of the site you are connecting to. A self signed cert provides zero use here.

So a self signed cert has some uses - that said, perhaps its the more techy person who would ever care about encrypted connections but not identity, and they can probably work out how to get FF to accept their cert anyway.

Re: Mozilla SSL policy bad for the Web

#54

Post by Herring »

sh1mmer wrote: post #26
ajross wrote: post #17

Earlier quoted context omitted.

That's not the bug though. The bug is that the error message a user sees when visiting a self-signed site using HTTPS is much more scary than simply visiting that site on an unencrypted connection, even though by all reasonable standards this is a safer, more private, and more secure action. If we're not going to warn folks about unencrypted links where every proxy in the way is a man-in-the-middle attack waiting to…

This is because users are being trained to use sites "with the yellow bar at the top" to do personal things (e.g logging in, credit card details, etc). Making users have to jump through a couple hoops of hoops if the certificate is self-signed is a good way to protect users that don't understand the technology. While I understand you want to be very egalitarian about it most users would value their personal informati…

Yeah it's a branding issue. The yellow bar or the lock at the bottom should indicate a "secure" site. A self signed cert is no different from a fraudulent cert.

Re: Mozilla SSL policy bad for the Web

#55

Post by jodrellblank »

tptacek wrote: post #31

Unbelievable. I've been poking about here for like 6 months now. You are all very smart people. Why is this so hard to understand? If you do not have a valid certificate signed by a CA, SSL is not providing any security . Yes, the warning you get when you visit a site with an invalid cert is much scarier than what you see if you visit an unencrypted site. But it's the sites that use encryption that users care about,…

To borrow from Eliezer, if you really can't believe something that is happening can happen, then your mental model is wrong.

I originally posted: Every time I have hit this message, it has been mostly irrelevant to me and disrupted what I was doing

[I'm no longer so certain - I can't be sure my router configs haven't been stolen by a MITM attack. I suppose I really ought to find out how to generate and install SSL certificates from a trusted root on them, and post them to someone at the remote sites on an encrypted pen drive.]

I manage a fair amount of networking kit, I find Google results to mailing lists with mysterious and pointless SSL connections. As someone posted in the "End of the Windows Era" thread: "I don't care what OS you have, as long as you have a reasonable browser". This isn't reasonable behaviour.

SSL does not prove anything useful - at the very most that you are connecting to the site your browser intended to connect to, assuming the site DNS hasn't been hacked.

Anyone can pay $20 and get a valid certificate and that doesn't mean you should trust them with your bank account details. Any site with a valid SSL cert might have been hacked behind the SSL termination. If you're scared of MITM attacks, aren't you just as scared of valid SSL certificates on sites with fake DNS or hacked servers?

Re: Mozilla SSL policy bad for the Web

#56

Post by plusbryan »

One possible solution: use two icons

Since SSL covers two cases of security, both encryption and identity, maybe it's time to invent a new icon - i.e. this web site is secure (a lock) but its identity could not be verified (an id card).

Self-signed certs wouldn't show warnings, but wouldn't show the ID-verified icon. CA certs would show both.

If they're worried about user education, the first time firefox encounters a self-signed site, it could provide a permanently dismissible dialog.

Re: Mozilla SSL policy bad for the Web

#57

Post by Herring »

jodrellblank wrote: post #55
tptacek wrote: post #31

Unbelievable. I've been poking about here for like 6 months now. You are all very smart people. Why is this so hard to understand? If you do not have a valid certificate signed by a CA, SSL is not providing any security . Yes, the warning you get when you visit a site with an invalid cert is much scarier than what you see if you visit an unencrypted site. But it's the sites that use encryption that users care about,…

To borrow from Eliezer, if you really can't believe something that is happening can happen, then your mental model is wrong. I originally posted: Every time I have hit this message, it has been mostly irrelevant to me and disrupted what I was doing [I'm no longer so certain - I can't be sure my router configs haven't been stolen by a MITM attack. I suppose I really ought to find out how to generate and install SSL ce…

use the star (*) symbol on both sides of the text to italicize.

Re: Mozilla SSL policy bad for the Web

#59

Post by nailer »

tptacek wrote: post #31

Unbelievable. I've been poking about here for like 6 months now. You are all very smart people. Why is this so hard to understand? If you do not have a valid certificate signed by a CA, SSL is not providing any security . Yes, the warning you get when you visit a site with an invalid cert is much scarier than what you see if you visit an unencrypted site. But it's the sites that use encryption that users care about,…

You might be overestimating the intelligence of your audience. Reddit, one of the ycombinator startups, famously kept all its users passwords in clear text, as 'using hashes was too hard' - until they were hacked.

Re: Mozilla SSL policy bad for the Web

#60

Post by tptacek »

ajross wrote: post #49
tptacek wrote: post #33

Earlier quoted context omitted.

The warning says, "Here is a site that claims to be secure. Maybe you thought it was secure, maybe you didn't. Either way, the site is not secure. DO NOT ENTER YOUR PASSWORDS AND CREDIT CARD NUMBERS HERE." The warning is vibrant because the condition it reports on can be created by an attacker on any SSL connection. That stupid warning might be among the top five security mechanisms on the Internet.

Why is a self-signed site insecure? Why isn't an HTTP site with a credit card prompt equally insecure (please, don't try to tell me that users look at the yellow bar -- we all know from direct experience that they don't)? Why is a properly certed site known to be secure for password use and credit card transactions? You're assuming all kinds of facts not in evidence. My point was simply that the FireFox tradition (no…

This clear incentive you speak of is not in evidence on the actual Internet: find a site any of us have ever heard of that takes a credit card over a bare HTTP connection by default.

Self-signed certificates are "insecure", if you want to use that word, because there is no way to verify them. If you're Bob sending your certificate to Alice, Alice has absolutely no way to tell if she's seeing your cert or Mallory's.

Self-signed certs get used in non-HTTP apps, and in internal apps, because an out-of-band mechanism (thumb drives, key continuity, etc) is being used to distribute the certificates. If Alice already has your cert, and all you have to do is prove you hold the privkey for it, you and Alice have no problem.

Of course, if you think about this for 5 more seconds, you quickly realize that nobody on the Internet has your cert already, and without Verisign to break the tie between you and Mallory, you're totally fucked.

Post reply on HN