Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Launching in 2015: A Certificate Authority to Encrypt the Entire Web

eff.org

Post reply on HN
Print view View original

261–270 of 476 posts

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#261

Post by patrickmcmanus »

Animats wrote: post #216

The EFF has a bad track record in this area. The last time they tried something to identify web sites, it was TRUSTe, a nonprofit set up by the EFF and headed by EFF's director. Then TRUSTe was spun off as a for-profit private company, reduced their standards, stopped publishing enforcement actions, and became a scam operation. The Federal Trade Commission just fined them: "TRUSTe Settles FTC Charges it Deceived Cons…

> If it's public static content, what is SSL protecting?

https:// helps protect the act of participation and deters the building of dossiers.

Its the difference between the books in the library and the list of books in the library you have read.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#262

Post by organsnyder »

rdrey wrote: post #18
sschueller wrote: post #4

A little vague on details. Apache only or also Nginx? Who is the CA? No way I am running something like this on a production machine. I like the idea but I would rather have the client just output the certificate and key in a dir so I can put the files where I need them and I can configure the changes to my webserver. Also this does not solve the issue of a CA issuing certificates for your domain and doing MITM.

I'm sure they'd support "manual setup". Not many sites would opt into running their software agent (yet). I'm expecting the client to come with a lot more benefits than "simple setup", though.

I think that plenty of site admins will be happy to run this software agent—remember, there are many site admins right now that aren't even bothered to set up TLS at all.

I run plenty of tools right now on production boxes that I personally haven't fully audited—we all do. This tool should be simple and widely used enough that it will be trustworthy.

For the cautious, it would be nice if the tool offered a mode that could be run as a normal user, even on a different machine. It'd have to be an interactive process:

1. "Enter domain to be signed." 2. "To validate ownership of the domain, create a TXT record on xxx.example.domain with 'na8sdnajsdnfkasdkey' as the value." 3. "Domain ownership has been validated. Please paste the CSR." 4. "The zone has been signed. Here is your certificate:"

Much less convenient (basically the same as the process with current CAs), but it would allow security-conscious admins to use the CA in a way that is comfortable for them. Since the tool is open source, it should be fairly easy for someone to write their own tool that speaks to the CA while providing this interactive process.

The tool is interesting and to be honest, I'll be comfortable using it (I'm not running anything high-profile or sensitive). However, the real news here is the new CA—the tool is merely a convenience.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#263

Post by lsh123 »

chetanahuja wrote: post #258
riffraff wrote: post #254

Earlier quoted context omitted.

but as user I can understand that an http site is insecure, while a self signed certificate might lead me into a false sense of security.

That's the proffered reasoning as we all know. But the actual outcome (to quote rufb from this comment https://news.ycombinator.com/item?id=8625739 ) Encrypted (Certified) COOL GREEN Encrypted (Self-Signed) EVIL RED Unencrypted NOTHING / NEUTRAL CHROME Tell me how the logic works here (for an average user).

I can self-sign a certificate for gmail, the browser correctly warns about potential BIG security issues with it.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#264

Post by AlyssaRowan »

Animats wrote: post #216

The EFF has a bad track record in this area. The last time they tried something to identify web sites, it was TRUSTe, a nonprofit set up by the EFF and headed by EFF's director. Then TRUSTe was spun off as a for-profit private company, reduced their standards, stopped publishing enforcement actions, and became a scam operation. The Federal Trade Commission just fined them: "TRUSTe Settles FTC Charges it Deceived Cons…

Regarding your first paragraph, I agree: all CAs need continuing scrutiny. Certificate Transparency, for example.

Regarding the rest of your post, however, I'm calling bullshit. You give very bad advice. Deploy TLS on every website. Deploy HTTP Strict-Transport-Security wherever you can.

The sites people visit are confidential, and yes, are not protected enough at the moment. (That will eventually improve, piece by piece.) That's absolutely no excuse at all for you not protecting data about the pages they're on or the specific things they're looking at, even if your site is static, or not protecting the integrity of your site. You have no excuse for that. Go do it.

Your other big problem is thinking that anything on your domain "doesn't need security"! Yes it does - unless you actually desire your website to be co-opted for use in malware planting by Nation-State Adversaries with access to Hacking Team(s) (~cough~) - or the insecure parts of your website being injected by a middleman with malicious JavaScript or someone else's "secure" login page that's http: with a lock favicon. (I have seen this in the wild, yes.) If you've deployed a site with that bad advice, it could be exploited like that today: go back and encrypt it properly before someone hacks your customers. This is why HSTS exists. Use it.

Regarding your CDN point, kindly cite - or demonstrate - your working "known attack" against Cloudflare's deployment?

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#265

Post by jsmthrowaway »

kaoD wrote: post #153
digitalsushi wrote: post #32

This certificate industry has been such a racket. It's not even tacit that there are two completely separate issues that certificates and encryption solve. They get conflated and non technical users rightly get confused about which thing is trying to solve a problem they aren't sure why they have. The certificate authorities are quite in love that the self-signed certificate errors are turning redder, bolder, and big…

Perhaps you should understand a system before slandering it? As others have said, encryption without authentication is useless. Running a CA has an associated cost, including maintenance, security, etc. That's what you pay for when you acquire a certificate. Whether current market prices' markup is too high would be a different question, but paying for a certificate is definitely not spending 200$ to look cool. CAs a…

That's the third comment of yours in which I've seen you taunt downvoters via edits in this thread alone. That's why I'm downvoting you. Knock it off, please.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#266

Post by cweagans »

dangrossman wrote: post #65
jadavis wrote: post #29

Earlier quoted context omitted.

If each domain name can get a non-wildcard cert for free, quickly, why do you need wildcard certs? For multi-subdomain hosting on one server? Just wondering.

Lots of services create dynamic subdomains in the form of "username.domain.com". To offer SSL on those domains without a wildcard certificate, you'd need to obtain a new certificate and a new IPv4 address every time a user signs up. You also need to update configuration and restart the web server process.

You don't need a new IPv4 address for each cert. That's for Windows XP. Just stop giving a shit about XP and use SNI. Problem solved.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#267

Post by nickf »

jfindley wrote: post #141

It would be nice to have support for ECDSA certificates. I've not found a CA yet who'll provide one of these, despite the fact that many clients to already support them. Unfortunately, after a brief look through client.py I can't see any support for this. Is there any good way of filing an RFE or contributing a patch? ECDSA certs are much cheaper to decrypt, and there's still some places (especially mobile) where TLS…

I can help get a ECDSA cert for you - my (personal) email is on my profile.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#268

Post by tacticus »

blendo wrote: post #155
seryoiupfurds wrote: post #133

Earlier quoted context omitted.

If the user typed www.mybank.com, let the server redirect to https but don't show the lock icon if it's self-signed. This is no worse than an impostor that just doesn't redirect to https. If the user typed https://www.mybank.com , show the usual warning for self-signed certificates.

This is EXACTLY what I want for my intranet sites. It lets me protect my users from the wireshark in the next cubicle.

The solution for this is to run your own CA internally and push out the cert to all the machines. (if you have byod stuff it makes it a little harder but you could still have an internal ca signing only a certain subdomain and get people ot install it)

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#269

Post by rpdillon »

hawleyal wrote: post #219
Joeri wrote: post #102

Earlier quoted context omitted.

Self-signed certificates are still better than http plain text. I understand not showing the padlock icon for self-signed certificates, I don't understand why you would warn people away from them when the worst case is that they are just as unsafe as when they use plain http. IMHO this browser behavior is completely nonsensical.

Because encryption with SSL without trust of the SSL cert is meaningless. It might as well be not encrypted.

I wonder if this is true.

If there's a man in the middle, then they can read the traffic. But others still have a problem.

With HTTP, you know that everyone can read the traffic.

I think unsigned certs, especially with pinning, can be used to make wholesale collection of internet traffic vastly more difficult.

Re: Launching in 2015: A Certificate Authority to Encrypt the Entire Web

#270

Post by Karunamon »

ghshephard wrote: post #211
tomp wrote: post #106

Earlier quoted context omitted.

NSA has NSL (national security letters with gag orders). There are CAs in the US. Mission accomplished.

Wouldn't help with google though - anybody who tried to fake a google cert would be caught by chrome within a few seconds. There is a lot of value associated with owning a browser. Enhanced security is just one of them.

You speak as if the power of NSLs has a functional limit - it doesn't, which is what makes the entire concept so dangerous.

There's nothing stopping the requirements from being "mint us a certificate according to these specs" and additionally "okay, now pin this certificate in your browser".

Post reply on HN