Everything you should know about certificates and PKI but are too afraid to ask • Hacker News Board

Re: Everything you should know about certificates and PKI but are too afraid to ask

#51

Post by therealdrag0 » Fri, Dec 14, 2018, 8:11 PM UTC

coldtea wrote: post #49

therealdrag0 wrote: post #48

Earlier quoted context omitted.

OTOH it's easy to dismiss something as overly complex before you understand it yourself.

It's even easier to build something that's more complex than needed, because of original bad design or accumulated cruft.

Definitely agree. Devs are often too comfortable with their first design instead of iterating and simplifying.

Re: Everything you should know about certificates and PKI but are too afraid to ask

#52

Post by castillar76 » Fri, Dec 14, 2018, 8:15 PM UTC

DyslexicAtheist wrote: post #14

PKI works. Period. I don't understand how knowledgeable engineers complain about PKI being "too complex". The same people complain that SMTP, DNS and NTP is too difficult too (and claim it can only be solved with external services). Granted having your own home-grown authentication & identity management "salad", or a very complex system that never addressed identity/authenticity, ... then replacing this with PKI will…

PKI absolutely works, but the complexity complaint is still valid. I work in PKI, and we often tell people that PKI is difficult to do correctly, easy to do wrong, and nearly impossible to remove once you've screwed it up. That's the fundamental difference between something like PKI and DNS. It's very easy to set up a PKI and get things to trust your chain, but if you haven't done the leg-work to figure out how you'll replace it when it expires/breaks/needs upgrading/gets compromised, you're totally hosed. I've seen more than one environment brought to its knees because it was easy to check the "use certificates for my AD environment" boxes in Windows (just as an example), and then the root CA is on a laptop in Jim-Bob's desk drawer and five years after he retires the whole network goes sideways and no one knows why or how to fix it.

Fortunately, as someone pointed out up-thread, the demand for new PKI being generated not just for SSL by things like Let's Encrypt but also by things like device-aware trust is helping encourage a trend in making it easier to do it correctly and harder to do it wrong. Not quite there yet, but showing signs of improvement.

Re: Everything you should know about certificates and PKI but are too afraid to ask

#53

Post by teddyh » Sat, Dec 15, 2018, 10:44 AM UTC

There is more to HTTPS than just certificates. For instance, the website lacks an HSTS header.

Re: Everything you should know about certificates and PKI but are too afraid to ask

#54

Post by black-tea » Sat, Dec 15, 2018, 5:38 PM UTC

Wildgoose wrote: post #47

Here's something nasty. The firewall where I am working (provided by Palo Alto Networks) can decrypt https and other "secure" traffic passing through it. I believe it auto-negotiates down to TLS 1.1 at which point it can decrypt everything to plain-text and can examine it to its hearts content. They are supposed to whitelist financial addresses (such as banking details) but would you trust that to be happening?

That's sadly quite normal in corporate networks. It only works because on your computer you have the firewall installed a root CA, though. If you didn't you would immediately be alerted of the man-in-the-middle attack the firewall is doing.