Hacker News Reader

Comment by codedokode | Hacker News Reader

[flagged]

This criticism/argument was, in fact, made against domain validation (DV) when it was first introduced by earlier CAs. It's not an unreasonable criticism, but the economics of PKI mean that we would have much, much less encryption and authentication on the web today without DV.

DV represents a security trade-off, and Let's Encrypt took this and ran with it, with the net effect of much much much much less web traffic interception overall, albeit with known non-Let's-Encrypt-specific vulnerabilities to attackers who can manipulate infrastructure sufficiently.

As other people in this thread have noted, there are also other mechanisms that can help mitigate those vulnerabilities. Maybe we can come up with more over time!

what? nothing to do with Let's Encrypt, if someone gets to large-scale MITM your traffic then they can get anyone to issue a DV cert.

So for example, if traffic to Google goes through a Huawei router somewhere, then Huawei can issue a Let's Encrypt certificate for Google, right? And any large national ISP can use MitM to issue fake certificates for any site hosted within that country?

To me it looks like SSL cert infra is completely compromised and unreliable.

> then Huawei can issue a Let's Encrypt certificate for Google, right?

Google has CAA records set (https://www.entrust.com/resources/certificate-solutions/tool...) and I guess CAs will have denylists of "popular" domains, so no.

> And any large national ISP can use MitM to issue fake certificates for any site hosted within that country?

Yes. You can fix this by CAA and ACME-CAA.

I can't think of a way to validate DV certificates in a better way that will resist this kind of attack.

Multiperspective validation, if the attacker is far enough away from the target site. :-)

I think some of the researchers who wrote about BGP spoofing attacks against Let's Encrypt may have suggested something about logging BGP changes and delaying DV issuance if a network's BGP announcements are too recent, or something? I don't think Let's Encrypt currently checks that, but it could be an interesting data source in the future.

Let's Encrypt uses "multiperspective validation" to prevent a single backbone router or backbone network from being able to do this attack in many cases.

This doesn't help much if the attacker is sufficiently close on the network to the target, or if the attacker can perform a successful wide-scale BGP spoofing attack.

I'm not sure if that will reassure you, since it's not a complete mitigation in all cases, but the multiperspective validation was explicitly created in response to exactly this kind of concern about attacks on, or by, ISPs!

> This shows that Let's Encrypt security is a joke because now any large national ISP can use same MiTM to issue a certificate for any site hosted within a country. The SSL infrastructure is completely compromised.

the information available right now are too vague to come to a conclusion this bold.

Instead, I find it something like the following more plausible:

jabber.ru and xmpp.ru seem to use "exotic" DNS servers (at least as I checked right now).

https://uk.godaddy.com/whois/results.aspx?itc=dlp_domain_who...

All it then takes is an exploit there in the DNS server, or a badly set-up ACME DNS-01 there, in order for Let's Encrypt to grant an SSL certificate.

https://letsencrypt.org/docs/challenge-types/#dns-01-challen...

The moment you're able to write a (TXT) record for some domain name, you have proven to be eligible for getting an SSL certificate for that domain name.

Both you and the grandparent are correct in that both propose viable attacks; it is a known fact (and not news to any expert in the space) that "domain validation" certificates are vulnerable to "global" MitM in which an attacker can intercept all traffic to a domain (and therefore intercept the validation probes). A situation in which a service's hosting company is sitting on their "front door" (so to speak) and MitMing all traffic that goes their way is exactly such a situation (hence my recommended mitigation).

Hosting company is not the only one who can do MitM; any ISP through which the traffic passes can do that as well; and if there are backdoors in foreign network equipment then the manufacturer of equipment can do MitM too.

This is false, because Let’s Encrypt uses servers in multiple places to get a mix of routing paths to eliminate it as an attack vector.

ns2.jabber.ru is hosted at Akado (ordinary Russian ISP) in Moscow, as for ns1.jabber.ru it looks like it is hosted at Linode. So maybe ns1 was compromised as well, as for ns2 I doubt that.

So because one is hosted in Moscow, you find it less likely to be hacked? What a humorous conclusion.

Yes, because it is highly unlikely that Russian police or Russian ISP will cooperate with US or European police.

Reply on news.ycombinator.com