Hacker News Reader

Comment by slownews45 | Hacker News Reader

There is a good one, but everyone is pushing the craptastic / megasize management solutions - so I don't think there is anyone out there yet for the 15 machine non AD (or light AD) domain type setups with third party stuff.

The solution would be to allow self signed + pinning.

You click to a new box on your network with a self signed cert. Instead of blocking you basically (yes, you can flag flip, go to advanced etc etc), it says, hey this is self signed cert, do you want to pin it? You say yes. It pins that cert to that internal IP.

Now you've got encryption.

Let's say in a rather far out case someone spoofs internal resolution. You are generally already owned at that point, but if they redirect IP X to a new cert, browser could have a popup saying - heads up, the cert for this IP now mismatches. Be very careful and do the current basic block/lockout approach.

View on HN

That's already what Firefox does. Despite not saying it clearly, if you accept a self-signed certificate, it will be used as long as it does not change.

> Let's say in a rather far out case someone spoofs internal resolution.

Seems trivial. Why wouldn't they?

> You are generally already owned at that point

Well, you might be, since your network is relying on self signed certificates with no PKI.

> heads up, the cert for this IP now mismatches.

Good thing everyone is already trained to click through certificate warnings.

Or you could just do PKI properly and avoid the entire issue, or not have an intranet and avoid the entire issue.

> Good thing everyone is already trained to click through certificate warnings.

With a proper UI there would be different messages when a cert mismatches compared to when a new cert is seen or the previous cert was about to expire. (Quite like Gemini browsers)

In the past, there were messages that specified exactly what was different about the situation, and they were by no means "proper UI":

https://docs.jboss.org/jbossas/guides/webguide/r2/en/html/im...

In fact, in the past, browsers used to helpfully give you warnings whenever you started using SSL:

http://acc6.its.brooklyn.cuny.edu/~core51/labs/extralab_file...

Different messages doesn't matter if people are just clicking through no matter what the message.

Even people who should know better. Even with other protocols like how SSH should work. We have clients who send us PPI and other data via SFTP. They do much to make themselves look paranoid: insisting on whitelisting source addresses, in some cases mandating PGP, insisting we pass certain audit requirements including things they may unilaterally make up in future, etc. But do they actually care enough to follow procedures and verify things before clicking through (or hitting the "Y" key)? No. How can I be so sure? I gave out the wrong host key fingerprint for a while (accidentally, I sent a dev/test host's fingerprint instead of the production one's identity) and no one came back to say "hey, this doesn't match, we can't proceed, could you look into why the target host identity doesn't match ASAP?" before I noticed my error.

If supposedly paranoid data management and security professionals are not Doing It Right and are just clicking through no matter what, you can bet your arse & mine that pretty much the rest of the world isn't doing things right, and probably never will, either.

TOFU like SSH or Gemini?

Exactly - this is actually pretty established already in SSH land.

Reply on news.ycombinator.com