Hacker News Reader

Comment by BoppreH | Hacker News Reader

    I know we could SSL sigaint.org, but if it is a state-actor 
    they could just use one of their CAs and mill a key.

Please don't use that argument. It's like not putting a lock on your door because thieves can just bust it open anyway.

It's true at face value, but you are ignoring that a) it keeps smaller attackers at bay and b) it makes noise when it breaks. In case of SSL the noise is that a user receives a valid but unusual certificate, which can be caught by something like the SSL Observatory (http://tor.stackexchange.com/a/1879).

View on HN

Yeah, the fact that they would make such an argument is a big red flag to stay away from their service.

There are currently zero known cases of intelligence agencies forcing CAs to sign bogus certs. If SIGAINT is the first victim of this approach then they will have done the whole security community a service by catching it and the CA that was coerced will be revoked.

But if they never use SSL at all then it's wide open to anyone at all, not even just governments. And it's hardly like governments are the only threats against people who use such services.

>There are currently zero known cases of intelligence agencies forcing CAs to sign bogus certs.

https://www.eff.org/deeplinks/2011/05/syrian-man-middle-agai...

https://www.eff.org/deeplinks/2011/08/iranian-man-middle-att...

http://securityaffairs.co/wordpress/32469/hacking/china-runs...

http://thehackernews.com/2014/10/chinese-government-executes...

> https://www.eff.org/deeplinks/2011/05/syrian-man-middle-agai....

> The attack is not extremely sophisticated: the certificate is invalid in user's browsers, and raises a security warning.

> https://www.eff.org/deeplinks/2011/08/iranian-man-middle-att....

DigiNotar was compromised, not compelled.

> http://securityaffairs.co/wordpress/32469/hacking/china-runs....

> the connection was established with a self-signed digital certificate.

> http://thehackernews.com/2014/10/chinese-government-executes....

> but the company’s SSL certificate is replaced by the intruders for a self-signed one

Fair point. I think the American TLAs know that the very day they are even once caught red-handed with a bogus CA-signed cert, the browser vendors will quickly start beefing up security with measures like DANE, making any attack on HTTPS even harder. This could also be disastrous to the breached CA's business, if browsers start rejecting it, which in turn could have major political implications - the overall revenue of the American CA companies measures in billions.

Surely they would have otherwise already done it, right? They certainly have the capability to compel a CA to do it.

France did it:

https://nakedsecurity.sophos.com/2013/12/09/serious-security...

http://googleonlinesecurity.blogspot.com/2013/12/further-imp...

I don't see any evidence of an intelligence agency being involved or of the CA being forced to sign the certs.

>ANSSI has found that the intermediate CA certificate was used in a commercial device, on a private network, to inspect encrypted traffic with the knowledge of the users on that network.

Most of those are not cases where a CA was forced to sign anything, that's just the government using their own untrusted CA.

Nobody is going to stop one trusting of the huge CAs like DigiCert or Verisign over something like that. It'd be like deciding you're not going to use Windows because there is a bug in it - you're too dependent on it to give it up and the alternatives are just as bad.

Who is too dependent on Windows and has no superior alternatives? This is a laughably weak argument that's getting weaker every day. It sounds like a personal problem.

Most normal users.

The 90%+ of computer users who have no idea how to install a different operating system?

I've continued to inflict Linux upon myself as my main (laptop!) OS for 12 years now, but you're deluded if you think it has any place on normal human being's computer. Windows works and is expected.

Expecting the user to spend hours/days learning a new system for reasons that aren't their own is bad assumption to make.

If Verisign was discovered to be routinely minting fake certs for the US Govt then they would be revoked. It would probably take over a year and involve huge amounts of pain but yes, it could be done. CAs sell a commodity product and are entirely replaceable.

Aside: There are literally dozens of CA keys baked into end user applications. An intel agency would only need to force some specific CA to sign a bogus cert if that agency somehow managed to not have the private key material to any of them. Any one will do to turn the padlock green, and that cert can be injected in a very targeted way.

The agencies complained a lot in the 90s about this technology, then they stopped complaining. So, they've either stopped doing their job, or ...

There's tons of CAs that can subvert security for most sites using SSL but also, if any of those CAs are caught issuing a bogus cert, which the cert presented to the user is proof of, they will be immediately blacklisted like DigiNotar and suddenly a whole CA is gone just for getting caught using it once.

And yet, TrustWave gets to keep their certificate despite doing the same thing intentionally (as opposed to accidentally through incompetence). The system does not work.

Catching one of these forged certs "in the wild" is harder if it only ever appears on the targets connection. If they happen to be anyone other than the fraction of a percent of users who understand things like "pinning", it is very low risk (today at least).

The ability to generate a CA cert trusted by a consumer CA store is a valuable asset that, like any intel asset, must be rationally deployed.

> The agencies complained a lot in the 90s about this technology, then they stopped complaining. So, they've either stopped doing their job, or

.... or they realised that nobody was deploying SSL outside of login forms and credit card purchases.

They don't even provide evidence as to why they think a state-actor is targeting them. The message seems like it was also built to promote their service.

I think it is mostly a result of their threat model -- they're a service which seeks to make things harder for those entities in particular.

Thar argument also assumes SSL using the traditional CA model. A self-signed certificate would completely eliminate a state actor or other rogue CA, as long as you have some other secure channel of disseminating the correct certificate publicly.

I wonder if keybase.io would work

And how are you authenticating keybase.io? SSL?

No, with a merkle tree and bitcoin: https://keybase.io/docs/server_security/merkle_root_in_bitco...

So we're basically just trusting keybase.io to do verification, instead of the CA system, Why them and not anyone else?

No. We're not. We're trusting math.

Trusting math alone is not enough. One of the reasons the CA system works is that there is a person who can be in the loop when things go cactus. With things like keybase, if your certificate gets compromised, that's it, game over man, game over. CAs, you can get certs replaced and the compromised certificate becomes worthless.

However, this does show the need for a generic method of certificate pinning. Using a DNS record type or the like would be able to add to the trust model, and make it much harder for a malicious actor to use a fake key, all without tying your trust database to a financial transaction.

> if your certificate gets compromised, that's it, game over man, game over.

We must choose between either "compromised -> scorched earth" or "compromised -> social engineering jackpot".

If you can distribute the key, you don't need to use a self signed. You can get a CA signed key,and distribute that, which is strictly more secure.

not only that, but Chrome can pin certificates: chrome://net-internals/#hsts

Reply on news.ycombinator.com