Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla SSL policy bad for the Web

cs.uml.edu

Post reply on HN
Print view View original

71–80 of 89 posts

Re: Mozilla SSL policy bad for the Web

#71

Post by jabr »

Dobbs wrote: post #66
iigs wrote: post #40

Earlier quoted context omitted.

Commercial certificates are not a scam. You're paying for a company (the CA) to certify (via the SSL cert signature) that an identity belongs to someone that has provided proof that they're who they say they are. You can absolutely do what you're requesting by creating your own CA and signing certs for your sites and distributing your CA cert to your users somehow. If you can figure out how to reliably provide this s…

What about a public key ssl server? Webmaster Bob wants to add his key to the server. Bob goes to the server page and hits add key button, puts in an email address for the webmaster, his public key and submits. Then the public key server sometime in the next couple hours goes outs and checks the website itself. If the two match it adds it to the database. You can have the server require a reverse DNS lookup and also…

Or you can just get a free DV cert from startssl.com and not have to do anything else.

Re: Mozilla SSL policy bad for the Web

#72

Post by nickf »

45454564654 wrote: post #50
huhtenberg wrote: post #27

Earlier quoted context omitted.

I'd like to know where I can buy a cert this way. Pretty please.

All that's require are scanned documents. And these documents can easily be tampered with or photoshopped. You may think your company details are checked before the cert is issued, but that's crap. We email our docs to a US company, and all the docs are issued by Irish government departments. There's no way in hell that some guy in what amounts to a call centre in the US has access to any Irish database to prove or d…

You can say it's crap all you want, but until you've worked inside a CA and seen what goes on - you know shit. Good luck ordering a cert with your 'shopped docs...

Re: Mozilla SSL policy bad for the Web

#73

Post by jodrellblank »

tptacek wrote: post #61
jodrellblank wrote: post #55

Earlier quoted context omitted.

To borrow from Eliezer, if you really can't believe something that is happening can happen, then your mental model is wrong. I originally posted: Every time I have hit this message, it has been mostly irrelevant to me and disrupted what I was doing [I'm no longer so certain - I can't be sure my router configs haven't been stolen by a MITM attack. I suppose I really ought to find out how to generate and install SSL ce…

The security of the DNS and the security of SSL are unrelated. This is one of those Reddit memes that won't die. You can claim to be bankofamerica.com all you want, but you cannot complete an SSL exchange with a signed certificate that says so.

Why not?

If Eve can take control of DNS and redirect bankofamerica.com to an IP on her servers, and it goes to a webserver with a ceritficate signed for "bankofamerica.com" by a widely trusted CA, then the browser will load it without complaint and show it as a padlocked site.

The only guard seems to be whether she can get any certificate company to sign a certificate for bankofamerica.com. Since it's cheap and easy to get basic SSL certificates from many places, this doesn't seem a very difficult obstacle for her to overcome with a bit of forging, social engineering, insider access, bribery, etc.

(I imagine that she could go to the real bankofamerica.com, save the certificate details it presents, and pass them on MITM style - but hope there are replay-prevention techniques involved. This doesn't affect the question above, though).

Re: Mozilla SSL policy bad for the Web

#74

Post by tptacek »

jodrellblank wrote: post #73
tptacek wrote: post #61

Earlier quoted context omitted.

The security of the DNS and the security of SSL are unrelated. This is one of those Reddit memes that won't die. You can claim to be bankofamerica.com all you want, but you cannot complete an SSL exchange with a signed certificate that says so.

Why not? If Eve can take control of DNS and redirect bankofamerica.com to an IP on her servers, and it goes to a webserver with a ceritficate signed for "bankofamerica.com" by a widely trusted CA, then the browser will load it without complaint and show it as a padlocked site. The only guard seems to be whether she can get any certificate company to sign a certificate for bankofamerica.com. Since it's cheap and easy…

The premise of your argument is that it is "cheap and easy" to get a certificate signed by a CA trusted by Firefox and IE for a "bankofamerica.com" domain.

It is not "cheap and easy" to get that certificate. As evidence for that argument, I put forth the fact that no criminal has ever managed to do it.

Now you're starting to see why certificates are so important to security of SSL!

Re: Mozilla SSL policy bad for the Web

#75

Post by paulgb »

DougBTX wrote: post #69
ajross wrote: post #49

Earlier quoted context omitted.

Why is a self-signed site insecure? Why isn't an HTTP site with a credit card prompt equally insecure (please, don't try to tell me that users look at the yellow bar -- we all know from direct experience that they don't)? Why is a properly certed site known to be secure for password use and credit card transactions? You're assuming all kinds of facts not in evidence. My point was simply that the FireFox tradition (no…

Imagine your bank's certificate says that they run their web site. If one day the certificate changes to a self-signed one, you have clear evidence of a man in the middle attack. What should the browser do in this situation? Someone pointed out that an HTTPS connection with an unknown self-signed certificate identifies the site just as well as a plain HTTP connection, suggesting that we should treat both connections…

Sure, but couldn't the man in the middle just as easily provide a non-SSL server? Or are you assuming that the user is accessing a bookmarked https:// url (in which case the browser should already know the correct certificate)?

Re: Mozilla SSL policy bad for the Web

#76

Post by gaika »

tptacek wrote: post #74
jodrellblank wrote: post #73

Earlier quoted context omitted.

Why not? If Eve can take control of DNS and redirect bankofamerica.com to an IP on her servers, and it goes to a webserver with a ceritficate signed for "bankofamerica.com" by a widely trusted CA, then the browser will load it without complaint and show it as a padlocked site. The only guard seems to be whether she can get any certificate company to sign a certificate for bankofamerica.com. Since it's cheap and easy…

The premise of your argument is that it is "cheap and easy" to get a certificate signed by a CA trusted by Firefox and IE for a "bankofamerica.com" domain. It is not "cheap and easy" to get that certificate. As evidence for that argument, I put forth the fact that no criminal has ever managed to do it. Now you're starting to see why certificates are so important to security of SSL!

It was cheap and easy to "steal" microsoft's certificate in 2001. http://cc.uoregon.edu/cnews/spring2001/mstheft.html

Re: Mozilla SSL policy bad for the Web

#77

Post by mindslight »

tptacek wrote: post #62
fendale wrote: post #53

Earlier quoted context omitted.

I don't fully agree with what you are saying. A self signed certificate DOES provide 100% cryptographic security, in that nobody sniffing on the the wire, or whatever open wi-fi I happen to be using can see my data. Securing the connection from 'spies' is only one part of an general SSL certificates function - the other is proving the identity of the site you are connecting to. A self signed cert provides zero use he…

Would you like to bet your social security on that statement? I'll win that bet. If I can watch your packets on the wire, I can inject my own packets, or redirect you to the middleman of my choosing. If I can inject my own packets, I can sub in my own certificate. You won't know, because you're using self-signed certificates --- meaning, meaningless certificates .

If I can watch your packets on the wire, I can inject my own packets

You're certainly persistent, but this is not strictly true.

1. Major links that are sniffed, summarized by ASICs, and backhauled. These are necessarily passive, and public key ops are too expensive to do at this scale.

2. Service providers would take a lot of heat from both the public and banks themselves if they started proxying encrypted connections to insert ads or track browsing history.

Re: Mozilla SSL policy bad for the Web

#78

Post by tptacek »

mindslight wrote: post #77
tptacek wrote: post #62

Earlier quoted context omitted.

Would you like to bet your social security on that statement? I'll win that bet. If I can watch your packets on the wire, I can inject my own packets, or redirect you to the middleman of my choosing. If I can inject my own packets, I can sub in my own certificate. You won't know, because you're using self-signed certificates --- meaning, meaningless certificates .

If I can watch your packets on the wire, I can inject my own packets You're certainly persistent, but this is not strictly true. 1. Major links that are sniffed, summarized by ASICs, and backhauled. These are necessarily passive, and public key ops are too expensive to do at this scale. 2. Service providers would take a lot of heat from both the public and banks themselves if they started proxying encrypted connectio…

If I can see your packets, I can sub in my own ARP (local) and DNS (remote) responses. In the absolute worst case, which never happens, I also see your TCP sequence numbers, and can simply inject segments directly. You have no hope of keeping me out of your connections. The "passive-only" attacker is a myth --- hackers don't use solsniff.c anymore.

Re: Mozilla SSL policy bad for the Web

#79

Post by tptacek »

gaika wrote: post #76
tptacek wrote: post #74

Earlier quoted context omitted.

The premise of your argument is that it is "cheap and easy" to get a certificate signed by a CA trusted by Firefox and IE for a "bankofamerica.com" domain. It is not "cheap and easy" to get that certificate. As evidence for that argument, I put forth the fact that no criminal has ever managed to do it. Now you're starting to see why certificates are so important to security of SSL!

It was cheap and easy to "steal" microsoft's certificate in 2001. http://cc.uoregon.edu/cnews/spring2001/mstheft.html

That event was so rare that it made national news, hasn't happened since, and has never happened to a financial institution.

If your argument is that Verisign sucks, though, I won't contest it. I'm not saying the CA business model is good; I'm saying that it's silly to say you can run SSL without CAs.

Re: Mozilla SSL policy bad for the Web

#80

Post by mindslight »

tptacek wrote: post #78
mindslight wrote: post #77

Earlier quoted context omitted.

If I can watch your packets on the wire, I can inject my own packets You're certainly persistent, but this is not strictly true. 1. Major links that are sniffed, summarized by ASICs, and backhauled. These are necessarily passive, and public key ops are too expensive to do at this scale. 2. Service providers would take a lot of heat from both the public and banks themselves if they started proxying encrypted connectio…

If I can see your packets, I can sub in my own ARP (local) and DNS (remote) responses. In the absolute worst case, which never happens, I also see your TCP sequence numbers, and can simply inject segments directly. You have no hope of keeping me out of your connections. The "passive-only" attacker is a myth --- hackers don't use solsniff.c anymore.

Yes, I've used ARP spoofing to perform MITM attacks.

You seem to be ignoring that some established institutions are malicious these days. An ISP can happily track their users all day long, and perhaps inject some ads that the average user won't care about.

However, an ISP cannot routinely proxy SSL connections. As I said, such blatant tampering would cause too many complaints (at least at this time). And is a bank supposed to accept risk from the ISP proxy being compromised?

When the gloves are off and ISPs are inserting themselves that far up the protocol, I'll gladly say that crypto without PKI is absolutely useless. Until then, there is a class of passive only attacker. Perhaps you don't see this kind of attack as a problem, but some of us do.

Post reply on HN