Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Acme, a brief history of one of the protocols which has changed the Internet

blog.brocas.org

Post reply on HN
Print view View original

61–70 of 91 posts

Re: Acme, a brief history of one of the protocols which has changed the Internet

#61

Post by pgporada »

pennomi wrote: post #35
donpdonp wrote: post #32

it seems like all this infrastructure could be replaced by a DNS TXT record with a public key that browsers could use to check the cert sent from the web server. A web server would load a self-signed cert (or whatever cert they wanted), and put the cert's public key into a DNS record for that hostname. Every visit to a website would need two lookups, one for address and one for key. It puts control back into the hand…

Ah but then how would nations spy on people by compromising the root certificate?

You're insinuating that the Let's Encrypt roots are compromised?

https://letsencrypt.org/repository/#isrg-legal-transparency-...

Re: Acme, a brief history of one of the protocols which has changed the Internet

#62

Post by crote »

franga2000 wrote: post #40
tzs wrote: post #34

Earlier quoted context omitted.

If someone can tamper with your DNS TXT records now they can get a certificate for your domain.

Not tamper with the record directly, but MitM it on the way to a target.

That's what DNSSEC is for.

Re: Acme, a brief history of one of the protocols which has changed the Internet

#63

Post by woodruffw »

dust42 wrote: post #55

To play the devils advocate: TLS on websites where you are not logged in is the greatest security hogwash of all times. For example the cookies of the NYT: - Store and/or access information on a device 178 vendors - Use limited data to select advertising 111 vendors - Create profiles for personalised advertising 135 vendors - Use profiles to select personalised advertising - Understand audiences through statistics or…

This has nothing to do with TLS’s security model. You still have to trust the site you’re connecting to.

Re: Acme, a brief history of one of the protocols which has changed the Internet

#64

Post by ishouldbework »

franga2000 wrote: post #40
tzs wrote: post #34

Earlier quoted context omitted.

If someone can tamper with your DNS TXT records now they can get a certificate for your domain.

Not tamper with the record directly, but MitM it on the way to a target.

That should be prevented by dnssec no?

Re: Acme, a brief history of one of the protocols which has changed the Internet

#65

Post by crote »

harrall wrote: post #36
336611629 wrote: post #17

Earlier quoted context omitted.

This problem was solved in the mid 2010s by Certificate Transparency. Every issued certificate that browsers trust must be logged to a public append-only certificate transparency log. As a result, you can scan the logs to see if any certs were issued for your domain for keys that you don't control (and many tools and companies exist to do this).

I wouldn’t consider it “solved” because most organizations and people don’t actually check the log. And a malicious actor can abuse this fact.

Having Chrome/Firefox asynchronously check the CT log 0.1% of the time would probably be enough to solve that.

CT logging is mandatory, and even a single missing cert is probably going to be an existential threat to any CA.

The fact that someone is checking is already enough of a deterrent to prevent large-scale attacks. And if you're worried about spearphishing-via-MitM, you should probably stick to Tor.

Re: Acme, a brief history of one of the protocols which has changed the Internet

#66

Post by stavros »

Vinnl wrote: post #59
stavros wrote: post #8

Let's Encrypt did more for privacy than any other organization. Before Let's Encrypt, we'd usually deploy TLS certificates, but as somewhat of an afterthought, and leaving HTTP accessible. They were a pain to (very manually) rotate once a year, too. It's hard to overstate just how much LE changed things. They made TLS the default, so much that you didn't have to keep unencrypted HTTP around any more. Kudos.

And with that, kudos to Mozilla, EFF and the University of Michigan for founding Let's Encrypt for just that purpose. (I do work at Mozilla now, but this predates me. Still think it's one of its most significant (and sadly often overlooked) contributions though.)

Yeah, massive massive contribution to the world. I can't think of many other nonprofits that had such an impact for the betterment if humanity.

Re: Acme, a brief history of one of the protocols which has changed the Internet

#67

Post by franga2000 »

crote wrote: post #62
franga2000 wrote: post #40

Earlier quoted context omitted.

Not tamper with the record directly, but MitM it on the way to a target.

That's what DNSSEC is for.

Yes, but that's just PKI again, which is what the OP was trying to avoid.

Re: Acme, a brief history of one of the protocols which has changed the Internet

#68

Post by 1vuio0pswjnm7 »

dust42 wrote: post #55

To play the devils advocate: TLS on websites where you are not logged in is the greatest security hogwash of all times. For example the cookies of the NYT: - Store and/or access information on a device 178 vendors - Use limited data to select advertising 111 vendors - Create profiles for personalised advertising 135 vendors - Use profiles to select personalised advertising - Understand audiences through statistics or…

"There is no way to escape any of this unless you spend several hours per week to click through these dialogs and to adjust adblockers."

I read NYT with no cookies, no Javascript and no images. Only the Host, User Agent (googlebot) and Connection headers are sent. TLS forward proxy sends requests over internet, not browser. No SNI. No meaningful "fingerprint" for advertising

This only requires accessing a single IP address used by NYT. No "vendors"

TLS is monitored on the network I own. By me

I inspect all TLS traffic. Otherwise connection fails

Re: Acme, a brief history of one of the protocols which has changed the Internet

#69

Post by phantasmish »

dust42 wrote: post #55

To play the devils advocate: TLS on websites where you are not logged in is the greatest security hogwash of all times. For example the cookies of the NYT: - Store and/or access information on a device 178 vendors - Use limited data to select advertising 111 vendors - Create profiles for personalised advertising 135 vendors - Use profiles to select personalised advertising - Understand audiences through statistics or…

> The NSA is no longer listening because there is TLS everywhere? Sure, and the earth is flat.

I’d be very surprised if they haven’t had several of the root trust entities compromised from day one. I wouldn’t rely on TLS with any of the typical widely-deployed trust chains for any secrecy at all if your opponent is US intelligence.

Post reply on HN