Hacker News Reader

Comment by _8j50 | Hacker News Reader

Can a TLS connection ever be considered end-to-end secure? I mean,it's perfectly acceptable for a middleware with a valid cert from an authorized CA to intercept the traffic before the true endpoint,not to mention loadbalancers and other possible TLS terminators.

As I understand it,end-to-end means application to application (endpoint to endpoint?) with assurance to the client that no middleware can intercept traffic successfully. Always thought TLS only assured the presenter of the ServerCertificate is authenticated for the subject,that is to say the client cannot say "I am sure this is the server I meant to communicate with",it can only say "The server I'm speaking with has authority to communicate on behalf of my intended peer"

View on HN

> perfectly acceptable for a middleware with a valid cert from an authorized CA to intercept the traffic

Wow, that is a LOT easier said then done. With today’s Certificate Transparency Log requirements, any new certificate must have a cryptographically verifiable entry into at least two different public logs. If a bad actor at a CA were to generate this trusted cert you described, there would have to be a public record of it for it to be trusted. Beyond that, if the CA was found to be complicit, then they would lose their trusted status- looking at you Symantec.

If they own the device they can install trusted root CAs that are not public or have CT logs. Anyway,question is if you can call TLS end to end or not.

Yes, if you own the device, you can choose what to trust beyond valid cert requirements. To answer your question, yes, I do consider TLS end-to-end despite involvement of a 3rd party. I believe certificate transparency has removed a lot of the trust issues around CAs that previously existed. Trust is no longer required when there is public verifiable logs. Also, with the trend moving towards short cert lifespans, the risk of certs being stolen and used against you is more difficult- requiring regular updates. I hope to see the max cert validity periods become shorter and shorter

That's ridiculous. The popular CAs are not part of the TLS standard and neither is CT. Plenty of intranet TLS with intetnal CAs. CTs are good if the end client only uses root CAs that participate.

Let's say CT solves the server authentication issues,how does does the server authenticate the client? End to end means both parties authenticate,TLS supports client authnetication but a) DNS over HTTPs isn't doing that b) even if it did there isn't CT for client certs...

What is the difference between "the server I meant to communicate with" and a "server ... with authority to communicate on behalf of my intended peer"?

This seems like a distinction with no meaningful difference, outside of esoteric things like hardware-based attestation where you actually do want to identify a peer with the specificity of an actual physical piece of equipment. As soon as we introduce names that are not physically bound, we have a level of indirection that erases any distinction you were making.

The difference is that one is verified by trusting the peer while the other is verified by trusting a 3rd party. So trust is me-3rd party-them. As opposed to end to end where it is me-them.

If the DNS client has a pinned certificate/key this would break the MiTM/Middleware.

But remember that you're only using the TLS connection for the DNS question and answer, so if you choose something like cloudflare/google/opendns then they'll configure their frontends/termination points with the respective pinned cert.

Once the lookup has taken place, the connection is made with the proper endpoint and a new TLS connection takes place using traditional mechanisms.

I feel that that most major providers have had enough of broken PKI infrastructure and bad uses that exposing DNS over TLS without something like Key pinning would be wise.

If you're pinning keys/certs,who needs a CA? If you don't need a CA,who needs the complicated TLS. I'd think wide adoption of TLS is the motivation,even then...DNS over QUIC?

Either way,I'm all for it,just don't think the "end to end" label is warranted.

Just a note, chrome is removing HPKP (public key pinning) validation. So this is unfortunately not true. I’m not going to go into the details here, but they basically believe it does more harm then good and that cert transparency logs achieve the same goal of taking away trust from the CAs.

Yeah,but now you're talking about browsers. You and others keep telling me how secure TLS and CA pki is,I never said otherwise. It's just not end to end. The subject here is dns over https and there certainly is no client auth here. TLS provides good transport security for the client. Not end to end,as in the CA infra for client auth isn't on par and even if it was CT is not TLS protocol feature and it's up to applications to verify CT,have only good root CAs and do client certs right

Reply on news.ycombinator.com