Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Subdomains + Development = Sucks: A quick tip from Kevin Hale of Wufoo

particletree.com

Post reply on HN
Print view View original

11–20 of 23 posts

Re: Subdomains + Development = Sucks: A quick tip from Kevin Hale of Wufoo

#11

Post by lupin_sansei »

timg wrote: post #10
lupin_sansei wrote: post #8

Earlier quoted context omitted.

The Authority provides a way to check the address of a domain name holder and other useful information. It makes it a lot harder for someone to create a spoof domain like https://www.paypa1.com and for Paypal's real address to be displayed in the certificate when you click on it. Basically Verisign and co stake their reputation on checking the details of the certificate applicant. I don't see what's terrible about br…

"""I don't see what's terrible about browser makers trusting certain authorities""" Because the authorities trust anyone who pays them 20 bucks. THEN, the users trust any site where the address bar turns yellow. Do you see the break in the chain here?

You're changing your argument, Your initial point was that encrypted HTTP should be free. It is.

Then you switched to say that you can't really trust Authorities. Maybe so, but the current setup seems better to me than the alternatives.

Re: Subdomains + Development = Sucks: A quick tip from Kevin Hale of Wufoo

#12

Post by timg »

mdakin wrote: post #9
timg wrote: post #7

Earlier quoted context omitted.

That's terrible in my book. What if you are running an entertainment site with lots of subdomains and for every single subdomain the user gets harassed with this question? These certificates have nothing at all to do with "authority." Just think about it, what exactly do they prove? Why should you only be allowed to speak in confidence with well identified parties (not that verisign remotely attempts to identify anyo…

The SSL software in your web browser uses the information from the certificate authority to mathematically PROVE a man in the middle attack is NOT happening. Anytime you use a self-signed certificate [edit] without manually verifying the fingerprint of certificate [/edit] ANYONE who controls the network hardware between you and the second party can eavesdrop and even tamper with the communication stream. Neither you…

"""Anytime you use a self-signed certificate ANYONE who controls the network hardware between you and the second party can eavesdrop and even tamper with the communication stream. Neither you nor the second party has any way of knowing what's going on. That's why we NEED a warning every time we encounter a self-signed certificate."""

I believe that you misunderstand the technology.

Re: Subdomains + Development = Sucks: A quick tip from Kevin Hale of Wufoo

#14

Post by lupin_sansei »

mdakin wrote: post #9
timg wrote: post #7

Earlier quoted context omitted.

That's terrible in my book. What if you are running an entertainment site with lots of subdomains and for every single subdomain the user gets harassed with this question? These certificates have nothing at all to do with "authority." Just think about it, what exactly do they prove? Why should you only be allowed to speak in confidence with well identified parties (not that verisign remotely attempts to identify anyo…

The SSL software in your web browser uses the information from the certificate authority to mathematically PROVE a man in the middle attack is NOT happening. Anytime you use a self-signed certificate [edit] without manually verifying the fingerprint of certificate [/edit] ANYONE who controls the network hardware between you and the second party can eavesdrop and even tamper with the communication stream. Neither you…

Doesn't the browser warn you by default for self-signed certificates? If so your second paragraph is incorrect isn't? You would get a warning every time you encounter a self signed certificate.

Re: Subdomains + Development = Sucks: A quick tip from Kevin Hale of Wufoo

#15

Post by timg »

lupin_sansei wrote: post #11
timg wrote: post #10

Earlier quoted context omitted.

"""I don't see what's terrible about browser makers trusting certain authorities""" Because the authorities trust anyone who pays them 20 bucks. THEN, the users trust any site where the address bar turns yellow. Do you see the break in the chain here?

You're changing your argument, Your initial point was that encrypted HTTP should be free. It is. Then you switched to say that you can't really trust Authorities. Maybe so, but the current setup seems better to me than the alternatives.

Read Schneier's take on it that I linked to. He agrees that this false sense of positive identification can be WORSE than none at all. And that has to do with the warnings that the browser gives, not the matching up of the domain names.

Second, my argument has always been that the browser should not harass the user of a site that has not taken part in this PHONY identification procedure.

Heck, even google adsense has seen through this scam and not bothered to pay the fee.

Edit: To clarify, most users equivocate signed SSL certificate == trustable site. That is WRONG. Verisign does not vigorously establish the non-evilness of your site.

Example: http://blog.washingtonpost.com/securityfix/2006/02/the_new_face_of_phishing_1.html

Re: Subdomains + Development = Sucks: A quick tip from Kevin Hale of Wufoo

#16

Post by bls »

timg wrote: post #5

What I hate is that firefox/IE complain if you don't get one of these paid SSL certificates. The encryption of HTTP traffic should be free and without unneeded burden.

Comodo and other SSL providers will give you free certs that don't cause any warnings. But, they only last 3 months instead of 1 year.

Re: Subdomains + Development = Sucks: A quick tip from Kevin Hale of Wufoo

#18

Post by mdakin »

lupin_sansei wrote: post #14
mdakin wrote: post #9

Earlier quoted context omitted.

The SSL software in your web browser uses the information from the certificate authority to mathematically PROVE a man in the middle attack is NOT happening. Anytime you use a self-signed certificate [edit] without manually verifying the fingerprint of certificate [/edit] ANYONE who controls the network hardware between you and the second party can eavesdrop and even tamper with the communication stream. Neither you…

Doesn't the browser warn you by default for self-signed certificates? If so your second paragraph is incorrect isn't? You would get a warning every time you encounter a self signed certificate.

The language in my post is a bit sloppy and for for that I apologize. As I imply in the second paragraph and explain in the edit you do get a warning BUT unless you then pull out your paper copy of the fingerprint and manually compare the fingerprint of the certificate with the one you have on file you do not know that your connection is secure. When is the last time anyone took that step? We need CAs to automate this process for us.

Re: Subdomains + Development = Sucks: A quick tip from Kevin Hale of Wufoo

#19

Post by mdakin »

timg wrote: post #12
mdakin wrote: post #9

Earlier quoted context omitted.

The SSL software in your web browser uses the information from the certificate authority to mathematically PROVE a man in the middle attack is NOT happening. Anytime you use a self-signed certificate [edit] without manually verifying the fingerprint of certificate [/edit] ANYONE who controls the network hardware between you and the second party can eavesdrop and even tamper with the communication stream. Neither you…

"""Anytime you use a self-signed certificate ANYONE who controls the network hardware between you and the second party can eavesdrop and even tamper with the communication stream. Neither you nor the second party has any way of knowing what's going on. That's why we NEED a warning every time we encounter a self-signed certificate.""" I believe that you misunderstand the technology.

I'm by no means an expert on crypto but I think I understand the fundamentals. If something I said is incorrect please point it out specifically. See [1] for a more complete explanation of my point.

[1] http://en.wikipedia.org/wiki/MITM

Post reply on HN