Comment by kpil | Hacker News Reader

Comment by kpil | Hacker News Reader

Irrelevant - it's way beyond repair.

There is virtually nil chance that none of the root CAs are compromised or influenced, or at least influenceable by a criminal organisation or group.

I also doubt that all governmental organisations that have the opportunity to legally influence the CAs have full control of all their employees and that they are not vulnerable to criminals.

I also doubt that the governmental organisations of the usual suspected countries involved in government funded industrial espionage are not able to influence CAs - in order to target information in other countries.

Actual lawful interception is inevitably possible - but it's a good thing so it can be ignored. Actual political espionage can also be ignored, as it is unlikely to happen to normal people and companies and nearly impossible to avoid without considerate resources.

But the first three scenarios are probable, and can cause serious economical harm, and can't be fixed without changing the whole current infrastructure.

> Irrelevant - it's way beyond repair.

Doesn't mean we shouldn't try, since we're not getting rid of if anytime soon.

Google's Certificate Transparency is a great approach.

I think the point the parent was making is that it is likely that one or more of the most prevalent certificate authorities' private keys have been compromised - whether voluntarily provided to government, or obtained by criminals via dubious methods.

Once the private keys are compromised, all bets are off. No database - whether maintained by Google or anyone else - puts a dent in such a problem. It's one thing to track inauthentic certificates; it's quite another to discover someone silently decrypting traffic with a copy of the private key.

Edit: My response brings up an interesting question I hadn't considered before. With the certificate chain, is it required to have the private keys for the entire chain in order to be able to decrypt the stream? If someone has the certificate authority top-level certificate, can they decrypt a domain's certificate without having its private key as well as any intermediates? If not then it'd be true that the primary concern with a top-level private key being compromised is illegitimate certificates being signed, in which case Google's attempt to combat that with Certificate Transparency isn't half bad.

Your edit is correct - it is the public certificate that is signed, so a cert authority never sees the private cert and can hence not decrypt downstream. The problem is issuing fake certificates.

As far as I know, you can't trivially decrypt traffic as a passive observer, even if you have the private key of the website or the CA. The sides still perform key exchange using something like Diffie-Hellman. The asymmetric keys are used to verify that you're performing the key exchange with the real server and not with a MITM.

If you have the CA's private you must sign your own fake certificate and MITM the connection with the fake certificate. In this case, as you pointed out, Certificate Transparency does help because the fake certificate won't be present in the certificate logs.

The 'all or nothing' take on security is a very childish or naive point of view.

No security system is invulnerable, and even the slightest inconvenience will prevent a certain percent of behavior.

In light of those two facts, you must speak about specific threats and attacks if you want to say anything about security.

For example: Compromised root CAs have not been found to be used by criminal gangs in bank phishing schemes. Therefore, they seem to provide about the right level of security for that threat.

Compromised CAs have been strongly implicated in government attacks, so they don't provide an adequate level of security in that context.

This doesn't mean they're beyond repair. They work for certain tasks in certain contexts, like your front door, or a safe, or a password, or a security guard.

> The 'all or nothing' take on security is a very childish or naive point of view.

I disagree; indeed, I think the idea that cryptography and security can be flawed-but-useful is itself naïve. If something is breakable, it will be broken; that's why we need to be using the best possible security protocols and standards.

> For example: Compromised root CAs have not been found to be used by criminal gangs in bank phishing schemes.

They've not been found, which means neither that they've never existed nor that they never will exist.

> If something is breakable, it will be broken

Whether it will be broken during the duration of your use by an attacker that you can realistically thwart is the question you must be asking, and that has different answers.

The ability to issue a malicious certificate gives you the ability to instantly mim any https connection.

So about as bad as it gets. Worse, because the user is under the impression there is at least some security on the connection which changes their behavior. - for example most users would now not enter financial details on a non https connection.

Does anyone know if there is a log stored in windows 10 of what root authorities were used by different domains?

I wasn't talking about this particular concern (which I agree with as being severe). Mine is with the mindset behind "perfect security" leading to worse security, that's all.

we dont disagree. Pointing out the change in behaviour is just another reason the perfect security mindset leads to worse security.

Weaknesses in a system are vulnerabilities. Exploits are the methods used on vulnerabilities.

A flawed TLS implementation might only be exploitable by nation states, or only be practical against high value targets. Or perhaps it's known humans are corruptible, but a transparent, auditable root CA is still better than name-your-Chinese-state-CA.

Security is a spectrum. It is not all or nothing. Sure, crypto algorithms should strive for perfect security, but a system with humans will be fallible and must be usable.

True.

I should not have said 'beyond repair'.

But the comparison to my front door is adequate. It is mostly of symbolic value. It is possible to gain entry to the house in 30 seconds.

It is at least not possible to just walk in without me noticing when I am at home.

Efforts like Certificate Transparency and HPKP solve most of these issues and do not require a full replacement of the Web PKI.

HPKP has the trust on first connect issue, because you can't preload every website.

It also has the potential to wreck your site.

Again, the root problem, which is universal, is the concentration of power. One company or group or place has so much power for everything in the world, and regulating them has been always the central problem of the human society.

But alas, we always need the concentration so badly for the sake of efficiency.

But alas, we always need the concentration so badly for the sake of efficiency.

Note that this is actually unproven. It is a dogma of modern economics, not an established fact.

Reply on news.ycombinator.com