Iran forged the wrong SSL certificate • Hacker News Board

Re: Iran forged the wrong SSL certificate

#111

Post by kragen » Fri, Sep 02, 2011, 5:18 AM UTC

tptacek wrote: post #105

kragen wrote: post #103

Earlier quoted context omitted.

Correct me if I'm wrong, but haven't you also attacked TOFU POP as being worse than the CA system? If I understand correctly, it was a limited form of TOFU POP that caught this attack. (And it seems like TOFU POP MONK would fix the remaining weaknesses of TOFU POP.)

I think key continuity is an even worse solution for Internet trust than CAs.

It seems to have worked better in this case. It also would have worked better in the Comodo case, but it wasn't deployed yet. It certainly works better for the intranet case. I can't identify the case where it doesn't work better. Can you help?

Re: Iran forged the wrong SSL certificate

#112

Post by cperciva » Fri, Sep 02, 2011, 6:18 AM UTC

tptacek wrote: post #109

cperciva wrote: post #106

Earlier quoted context omitted.

I am not a fan of the HTTPS/TLS CA system. You know I'm not. Yeah, but to 99.99% of people out there, the existing CA system is an integral part of TLS. Every time you tell people to use TLS, you're (inadvertently) encouraging them to trust the certificate authority structure.

No I'm not.

Umm... care to elaborate? I'm not sure which bit you're disagreeing with here.

Re: Iran forged the wrong SSL certificate

#113

Post by stanleydrew » Fri, Sep 02, 2011, 4:06 PM UTC

Nick_C wrote: post #107

stanleydrew wrote: post #85

Earlier quoted context omitted.

Chrome has some script-control features built in that I use heavily. What would I gain from a chrome extension?

I can't find anything that provides those features. Can you let us know where it is? (Chrome 13.0.782.112 on Linux)

settings -> under the hood -> content settings

Re: Iran forged the wrong SSL certificate

#114

Post by Nick_C » Sat, Sep 03, 2011, 1:42 AM UTC

stanleydrew wrote: post #113

Nick_C wrote: post #107

Earlier quoted context omitted.

I can't find anything that provides those features. Can you let us know where it is? (Chrome 13.0.782.112 on Linux)

settings -> under the hood -> content settings

Oh, ok, I did know about that one.

Why I use NotScripts: the extension lets you enable JS temporarily or permanently for a particular website with just a mouse click. As well, at the same time, you can do the same thing for any third-party JS because it presents you with a list of them. So you can enable jsquery and disable google-tracker at the same time.

It's much easier than navigating the menu system to add an exception to the list of blocked sites for each time you just want to read a PDF, for example. That's the main use-case for me.

Re: Iran forged the wrong SSL certificate

#115

Post by count » Mon, Sep 05, 2011, 3:56 AM UTC

rdl wrote: post #93

count wrote: post #83

Earlier quoted context omitted.

Hell, for DOD systems on secure networks, you're required to remove all of the non-DOD root CAs. No DigiNotar or GoDaddy or the hundreds of others allowed.

DoD systems on secure networks shouldn't have IP connectivity outside DoD, though. The only issue is code signing keys for activex/java. (which really shouldn't exist on DoD secure networks either, but they've fully drunk the MS kool-aid)

That would be in a perfect world. Unfortunately, the world is pretty messy.