81–90 of 91 posts
Let's Encrypt did more for privacy than any other organization. Before Let's Encrypt, we'd usually deploy TLS certificates, but as somewhat of an afterthought, and leaving HTTP accessible. They were a pain to (very manually) rotate once a year, too. It's hard to overstate just how much LE changed things. They made TLS the default, so much that you didn't have to keep unencrypted HTTP around any more. Kudos.
Let's Encrypt did more for privacy than any other organization. Before Let's Encrypt, we'd usually deploy TLS certificates, but as somewhat of an afterthought, and leaving HTTP accessible. They were a pain to (very manually) rotate once a year, too. It's hard to overstate just how much LE changed things. They made TLS the default, so much that you didn't have to keep unencrypted HTTP around any more. Kudos.
LE allowed more sites to get certificates. This has obvious benefits for e-commerce, for example
But so-called "tech" companies, e.g., "Big Tech", have, since before and after LE was started, continued to perform the largest mass scale intentional erosion of privacy in human history
The exfiltrated data is encrypted in transit using TLS. This may prevent ISPs or other passive network observers from competing with the so-called "tech" companies in the data collection, surveillance and ad services business
Arguably the use of TLS certificates increases privacy from ISPs or other passive network observers, but it does not increase privacy from so-called "tech" companies, who are perhaps the greatest threat to privacy that computer users face. Their "business model" depends on violating privacy norms
And, in fact, commercial CA certificates as pre-installed in browsers and required on the www ("WebPKI") effectively obstructs computer users from monitoring their own egress traffic in real-time. Hence corporations and other computer users must work around "WebPKI" to perform "TLS inspection"
M
Earlier quoted context omitted.
I know that. But presumably, Let's Encrypt could participate in a MITM attack since they can sign another key, so that even the visitor who knows that you use them as a CA can't tell there is a MITM. Checking multiple signatures on the same key could raise the bar for a MITM attack, requiring multiple CA's to participate. I can't be the first person to think of this. I'm not even a web security guy. It might be inter…
This problem was solved in the mid 2010s by Certificate Transparency. Every issued certificate that browsers trust must be logged to a public append-only certificate transparency log. As a result, you can scan the logs to see if any certs were issued for your domain for keys that you don't control (and many tools and companies exist to do this).
Let's Encrypt did more for privacy than any other organization. Before Let's Encrypt, we'd usually deploy TLS certificates, but as somewhat of an afterthought, and leaving HTTP accessible. They were a pain to (very manually) rotate once a year, too. It's hard to overstate just how much LE changed things. They made TLS the default, so much that you didn't have to keep unencrypted HTTP around any more. Kudos.
"Let's Encrypt did more for privacy than any other organization." LE allowed more sites to get certificates. This has obvious benefits for e-commerce, for example But so-called "tech" companies, e.g., "Big Tech", have, since before and after LE was started, continued to perform the largest mass scale intentional erosion of privacy in human history The exfiltrated data is encrypted in transit using TLS. This may preve…
Earlier quoted context omitted.
I wouldn’t consider it “solved” because most organizations and people don’t actually check the log. And a malicious actor can abuse this fact.
Having Chrome/Firefox asynchronously check the CT log 0.1% of the time would probably be enough to solve that. CT logging is mandatory, and even a single missing cert is probably going to be an existential threat to any CA. The fact that someone is checking is already enough of a deterrent to prevent large-scale attacks. And if you're worried about spearphishing-via-MitM, you should probably stick to Tor.
Earlier quoted context omitted.
You can do it if you're happy to deploy your CA to your network, can't you? Deploying CA certs sucks, though. I wish it was easier.
It's one of those things that may be technically possible but that doesn't matter unless a large enough percentage of other people are doing it too. Now that everything is geared to be realtime, anything most people will want to do on a computer will have those kind of traffic patterns. Even our popular application platforms are set up to encourage this pattern. Electron being a browser engine is geared around making…
Earlier quoted context omitted.
Redirection doesn't get the job done, without at least a mechanism so that browsers reliably stop visiting the HTTP site (HSTS) and ideally an HTTPS-everywhere feature which, in turn, was not deployable for ordinary people until almost every common site they visit is HTTPS enabled and works properly. The problem is that there are active bad guys. Redirection means when there are no bad guys or only passive bad guys,…
> Users who go to http://mysite.example/ would be "redirected" to https://mysite.example/ but that redirection wasn't protected so instead the active bad guy ensures they're redirected to https://scam.example/mysite/ and look, it has the padlock symbol and it says mysite in the bar, what more do you want? You can do better than this. You can have your mitm proxy follow the SSL redirect itself , but still present plai…
To play the devils advocate: TLS on websites where you are not logged in is the greatest security hogwash of all times. For example the cookies of the NYT: - Store and/or access information on a device 178 vendors - Use limited data to select advertising 111 vendors - Create profiles for personalised advertising 135 vendors - Use profiles to select personalised advertising - Understand audiences through statistics or…
"There is no way to escape any of this unless you spend several hours per week to click through these dialogs and to adjust adblockers." I read NYT with no cookies, no Javascript and no images. Only the Host, User Agent (googlebot) and Connection headers are sent. TLS forward proxy sends requests over internet, not browser. No SNI. No meaningful "fingerprint" for advertising This only requires accessing a single IP a…
Earlier quoted context omitted.
It's one of those things that may be technically possible but that doesn't matter unless a large enough percentage of other people are doing it too. Now that everything is geared to be realtime, anything most people will want to do on a computer will have those kind of traffic patterns. Even our popular application platforms are set up to encourage this pattern. Electron being a browser engine is geared around making…
Maybe I misunderstood your point. Why do you need everybody to be doing it?
Earlier quoted context omitted.
"There is no way to escape any of this unless you spend several hours per week to click through these dialogs and to adjust adblockers." I read NYT with no cookies, no Javascript and no images. Only the Host, User Agent (googlebot) and Connection headers are sent. TLS forward proxy sends requests over internet, not browser. No SNI. No meaningful "fingerprint" for advertising This only requires accessing a single IP a…
Just curious, what is your tech stack to life inspect all TLS traffic?
A variety of software can be used
Anything from something like socat up to a large proxy server will work