Trusted End Node Security • Hacker News Board

Re: Trusted End Node Security

#21

Post by solatic » Tue, Apr 10, 2018, 2:30 PM UTC

more_pylons wrote: post #17

eadmund wrote: post #15

Earlier quoted context omitted.

> I personaly cannot think of a good reason they do this. Maybe they argue that they don't trust any CA Authorities other than themselves They do it precisely because they cannot trust any other CAs. You cannot trust any CAs — and yet you do. Go into your browser: odds are you have CAs controlled by the Russian, Chinese & Turkish governments. You're not just trusting those CAs to issue certificates for .cn, .ru or .t…

Fair point, I didn't really consider the issue with the other CAs that are currently trusted. Isn't it a double edge sword though with what they chose to do instead? By the DoD using their own CA people accessing their sites externally or on non-DoD devices cannot reliably know if they're being ease dropped on either. It has it's benefits for DoD employees using DoD devices but anyone outside the DoD needs to roll th…

99%+ of DoD traffic will be from DoD-managed endpoints, which will be managed and have the DoD CA certificates installed. The DoD use case doesn't typically require them to cater to outside users, with possible exceptions for things like recruiting, which can be handled on separate networks.

Re: Trusted End Node Security

#22

Post by solatic » Tue, Apr 10, 2018, 2:37 PM UTC

more_pylons wrote: post #13

jonathanstrange wrote: post #11

Earlier quoted context omitted.

Out of curiosity, what are those obvious reasons? Is it because the US military is less trustworthy than other US government institutions or, say, Chinese and Turkish government CAs? Edit: To make this clear, I'm not interested in a spurious political debate, I'm really just interested in the reasons / who decided this e.g. for my browser Firefox on the basis of what reasons.

I have ranted to co-workers for years now about the DoD with their third party root CA cert. I never know if the link I'm accessing is actually for the DoD or not. I personaly cannot think of a good reason they do this. Maybe they argue that they don't trust any CA Authorities other than themselves due to issues in the past like with symantec https://searchsecurity.techtarget.com/podcast/Risk-Repeat-Ba... or entrust

To add onto what eadmund wrote, militaries need to control their own CAs, lest critical systems become disrupted due to the revocation of their certificates by civilian CAs who were hacked (including physical or employment infiltration) by a foreign military. In order to secure military systems, the military would then have to take over the civilian CA, either formally or informally (by defining standards and dictating employment), which is a non-starter. Militaries further do have the resources to manage their own CAs internally, so the cost of running their own CA is a non-issue.

Public companies don't typically have "our CA getting hacked by a foreign power in a war affecting all our traffic" as a part of their threat model, which is why public companies can use public CAs without worry.

Re: Trusted End Node Security

#23

Post by devy » Tue, Apr 10, 2018, 3:20 PM UTC

jlgaddis wrote: post #8

Folks, the reason you get a certificate error is because this .mil site uses a certificate signed by the DoD CAs and none of the major OS/browsers ship with them pre-installed (for what should be obvious reasons).

Other than reasons like others mentioned: security and/or not following public CA guidelines, there are also other government sites with invalid TLS certificates due to incompetence. I.E. https://www.12306.cn, the TLS cert is valid and signed by DigiCert but the common name field was not matching the domain the site is serving. ¯\_(ツ)_/¯ Also, I recalled they would asked you to download their own root cert to during the checkout process. This is a high-speed rail ticketing site being used by billions of people every year. Go figure.

Re: Trusted End Node Security

#24

Post by 4ad » Tue, Apr 10, 2018, 3:51 PM UTC

acqq wrote: post #4

Detry322 wrote: post #2

This doesn't work for me - I need to have the Department of Defense root certificate installed, but I'm not sure I'm willing to do that...

No you don't. At least not even on old IE 11, and I can't imagine any other browser doing it worse (and I know Firefox). The browser is supposed to allow you to access the site my just confirming that you want. No root certificates.

On Safari the only option to proceed requires installing the DoD certificate.

Re: Trusted End Node Security

#25

Post by lasermike026 » Tue, Apr 10, 2018, 4:03 PM UTC

Now that's a logo.

Re: Trusted End Node Security

#26

Post by quantized1 » Tue, Apr 10, 2018, 5:16 PM UTC

Its a partial fact. Unless you put principal in picture, appreciation figure along is of no use. And in case of sanjose housing, the ratio is not that impressive

Re: Trusted End Node Security

#27

Post by matthberg » Tue, Apr 10, 2018, 5:22 PM UTC

"TENS differs from traditional operating systems in that it isn't continually patched"

Uh-oh. They argue that this is not an issue since the drive is read only, preventing any persistence of malware between sessions. However, this still means that there are known and fixable holes in the system which are exposed in using TENS; just because the malware goes away when you reboot, doesn't make it ok to allow malware in in the first place.

Also, what about literally any hardware security threats, like physical keyloggers or any evil low level software (bios, eufi, etc)

Re: Trusted End Node Security

#28

Post by m-p-3 » Tue, Apr 10, 2018, 5:33 PM UTC

more_pylons wrote: post #13

jonathanstrange wrote: post #11

Earlier quoted context omitted.

Out of curiosity, what are those obvious reasons? Is it because the US military is less trustworthy than other US government institutions or, say, Chinese and Turkish government CAs? Edit: To make this clear, I'm not interested in a spurious political debate, I'm really just interested in the reasons / who decided this e.g. for my browser Firefox on the basis of what reasons.

I have ranted to co-workers for years now about the DoD with their third party root CA cert. I never know if the link I'm accessing is actually for the DoD or not. I personaly cannot think of a good reason they do this. Maybe they argue that they don't trust any CA Authorities other than themselves due to issues in the past like with symantec https://searchsecurity.techtarget.com/podcast/Risk-Repeat-Ba... or entrust

> I personaly cannot think of a good reason they do this. They cannot trust anyone else but themselves, they have to be fully in control of the whole chain of certificates.

They are in a kind of unique position.

Re: Trusted End Node Security

#29

Post by more_pylons » Tue, Apr 10, 2018, 5:44 PM UTC

solatic wrote: post #21

more_pylons wrote: post #17

Earlier quoted context omitted.

Fair point, I didn't really consider the issue with the other CAs that are currently trusted. Isn't it a double edge sword though with what they chose to do instead? By the DoD using their own CA people accessing their sites externally or on non-DoD devices cannot reliably know if they're being ease dropped on either. It has it's benefits for DoD employees using DoD devices but anyone outside the DoD needs to roll th…

99%+ of DoD traffic will be from DoD-managed endpoints, which will be managed and have the DoD CA certificates installed. The DoD use case doesn't typically require them to cater to outside users, with possible exceptions for things like recruiting, which can be handled on separate networks.

I've personally been on support screen sharing conferences with the DoD before as a third-party consultant/contractor. They do not provide all contractors, especially third party, with DoD managed devices and in those cases I always thought that it was a bad practice. I asked for the people on the conference to e-mail me the root CA cert to validate the thumbprint was the same as the site but I'm not sure everyone would do that and instead blindly choose the 'proceed anyways' option.

/edit. That was a very long time ago though so I'm not sure if they're even using that same screen sharing site anymore or if they've since changed it to use a public CA root cert.

Re: Trusted End Node Security

#30

Post by acqq » Tue, Apr 10, 2018, 10:22 PM UTC

4ad wrote: post #24

acqq wrote: post #4

Earlier quoted context omitted.

No you don't. At least not even on old IE 11, and I can't imagine any other browser doing it worse (and I know Firefox). The browser is supposed to allow you to access the site my just confirming that you want. No root certificates.

On Safari the only option to proceed requires installing the DoD certificate.

I used mobile Safari both on iOS 11 and iOS 10 with no problem on that site. Also on mac OS, at least according to this picture, it's not the CA that's accepted, just the exact site certificate and only for the given site:

https://i.stack.imgur.com/vqOBP.png