Hacker News Reader

Comment by tptacek | Hacker News Reader

I'm not following. Browser or no browser, every cert eMudhra issues has to generate an SCT.

Every cert an attacker issues with eMudhra's private key has to appear in the CT logs if they want it to validate in a modern browser.

But if you only want to MITM the connection used by 'pip' to install python wheels - that doesn't check for CT records at all.

Seems like we need to upgrade all software to start using CT records then?

Sure, but a client that doesn't do CT wouldn't care if they don't include a SCT promise. [ed.: this said "break the SCT promise", that doesn't quite make sense] Which you'd only notice if you see the certificate somewhere else afterwards…

It's all rather hypothetical and unlikely, but you could certainly try attacking something like downloads.openwrt.org¹ like that — especially if you can tell apart the TLS client in opkg from a normal browser.

(¹ luckily, OpenWRT and most other package repos don't actually rely on HTTPS for package integrity and authenticity. And OpenWRT would be the most susceptible due to the "exotic" TLS client stack, if any.)

I’m surprised to see this username above this comment.

No, the cert can be issued with no (or invalid/junk) SCT and will work fine with clients who don’t check SCT, which is most non-browser interaction.

To spell it out a bit further, an attack strictly in a non-browser context that is reasonably well targeted will most likely go undetected since what the attacker is up against is the chance of inadvertently running into a paranoid user who goes out of his way to perform verification.

No, it doesn't. A certificate may or may not include CT info, or include fake CT info. Most TLS clients accept certificates without checking for CT.

SCT enforcement falls to the client though, yeah? What's stopping someone from signing a rogue cert silently which is accepted by CT-lenient clients?

Right, but you don't have to wait for some hapless random browser to check; you can write your own monitor, and people do that.

I hold eMudhra's private key. I generate a cert signed by their intermediate on my box. eMudhra didn't issue the cert, so it is not sent to any CT logs, and I have no SCT to put in the cert.

Am I missing what you mean by monitor?

I think I might just be talking past you. If your point is "anyone with these broken eMudhra keys can attack users without caring about CT", that's totally true --- it's just that browser/no-browser doesn't factor into it. I'm really only on this subthread because of the notion that CT enforcement requires browsers.

Right, I think I'm with you that browser/no browser shouldn't be a factor. I think I'd like to hear from Rust and Go webpki people on whether we could help the ecosystem enforce CT.

My point is more that as a user of a high-level library like reqwest, I'd like to talk safer defaults when root CAs are in use

Right, OK, I was misunderstanding the point you were making. Thanks!

Reply on news.ycombinator.com