FYI - I'm not the author of the article. I found it very useful and hence posted it here on HN.
Everything you should know about certificates and PKI but are too afraid to ask
11–20 of 54 posts
Re: Everything you should know about certificates and PKI but are too afraid to ask
#12Love it. Very elaborate and informative.
Re: Everything you should know about certificates and PKI but are too afraid to ask
#13The stuff about CAA is wrong.
CAA is NOT checked by browsers, the BRs do not say browsers should check CAA, and indeed it is specifically NOT designed to be checked by RPs at all. CAA tells the Issuers (Certificate Authorities) whether the name owner authorises them to issue at a moment in time.
If you think "that seems useless" it's probably because you completely misunderstood the security model it's written for. We don't want untrustworthy or incompetent CAs at all, this is not a guard against those. This is a guard against trustworthy, competent CAs that you've got your own reasons to disallow for your specific names.
Example: Facebook for years had a single preferred CA and their contract with that CA said everything gets signed off by the certificates team. After Let's Encrypt came on the scene a subcontractor developing example.facebook.com needed HTTPS, didn't read all the paperwork from Facebook and just got a cert from Let's Encrypt. Facebook security freaked out because their team hadn't authorised this weird new certificate. Let's Encrypt did nothing wrong, but it looked exactly like an attack. CAA lets Facebook tell every CA except the one that knows about their internal policy, "Thanks, but no thanks". Let's Encrypt would have checked CAA and told the subcontractor "Sorry, no, policy forbids, check CAA" and when they went to Facebook to ask why they'd have got an earful for not obeying policy.
Re: Everything you should know about certificates and PKI but are too afraid to ask
#14PKI works. Period. I don't understand how knowledgeable engineers complain about PKI being "too complex". The same people complain that SMTP, DNS and NTP is too difficult too (and claim it can only be solved with external services).
Granted having your own home-grown authentication & identity management "salad", or a very complex system that never addressed identity/authenticity, ... then replacing this with PKI will force you to deal with a lot of technical debt. But don't blame PKI for it.
Blaming PKI has become rampant. Those that don't know can't dispute the nonsense and those that do know may have an agenda (snake oil vendors).
Hating on PKI has become like a bad habit in IoT (vendors see an opportunity to sell trash to an uninformed and ignorant audience). Be careful especially in IoT: There are a lot of snake oil proposals which promise to replace PKI here ... you should run as fast whenever you see these "proprietary, patent-pending, post-quantum-proof, blockchain solutions !! (the correct response to these vendors is: "BEGONE MAGICIAN!").
PKI isn't easy but neither is email, Kubernetes! It's as simply as it can be given the circumstance and job it has to solve. And PKI is essential knowledge as much as Latin is required for medicine.
Re: Everything you should know about certificates and PKI but are too afraid to ask
#15Re: Everything you should know about certificates and PKI but are too afraid to ask
#16PKI works. Period. I don't understand how knowledgeable engineers complain about PKI being "too complex". The same people complain that SMTP, DNS and NTP is too difficult too (and claim it can only be solved with external services). Granted having your own home-grown authentication & identity management "salad", or a very complex system that never addressed identity/authenticity, ... then replacing this with PKI will…
>PKI works. Period. I don't understand how knowledgeable engineers complain about PKI being "too complex". The same people complain that SMTP, DNS and NTP is too difficult too
Perhaps as knowledgeable engineers they can understand accidental complexity when they see it.
Re: Everything you should know about certificates and PKI but are too afraid to ask
#17This is really good. Reformat it and turn it in to a book. Market it as essential reading for anyone running or thinking about running kubernetes or vault. Edit: actually this is way more in depth than is needed for k8s. But, I think that's a good target market for a book you can sell like candy for $25.
$25 for what would amount to a 30 page book? I sincerely hope nobody is gullible enough to pay that much for information that can be found quite easily for free.
Re: Everything you should know about certificates and PKI but are too afraid to ask
#18This is really good. Reformat it and turn it in to a book. Market it as essential reading for anyone running or thinking about running kubernetes or vault. Edit: actually this is way more in depth than is needed for k8s. But, I think that's a good target market for a book you can sell like candy for $25.
I'm curious - I've never seen tech books that short that people actually buy. Could you link some example? The closest I know of are the Julia Evans' zines, but I think you meant something different.
>I'm curious - I've never seen tech books that short that people actually buy.
Not sure about 20 pages or so, but there's a whole variety of short tech books. O'Reilly had their "pocket reference" series, some of which are less than 100 pages.
Re: Everything you should know about certificates and PKI but are too afraid to ask
#19PKI works. Period. I don't understand how knowledgeable engineers complain about PKI being "too complex". The same people complain that SMTP, DNS and NTP is too difficult too (and claim it can only be solved with external services). Granted having your own home-grown authentication & identity management "salad", or a very complex system that never addressed identity/authenticity, ... then replacing this with PKI will…
I don't think I've ever heard anyone say that SMTP the protocol is too complex.
However, the systems that people build on top of SMTP (often to address shortcomings in SMTP being too simple) can often be Lovecraftian horrors.
Re: Everything you should know about certificates and PKI but are too afraid to ask
#20[deleted]