Hacker News Reader

Comment by tptacek | Hacker News Reader

This is why calls to make click-throughs for self-signed certificates simpler and less scary are misguided.

People don't really want self-signed certificates; they just think they want them. When you drill down enough with the "what are you really trying to accomplish here?" questions, people just want a CA that gives them free certs, as many as they like, as often as they like--possibly through an API, even--with no background checks needed, and yet somehow also still protects them from an attacker using exactly the same kind of carefree CA to generate a cert for the same domain. And a pony.

[In other words, people want cert-pinning with a distributed pin cache to prevent initial-session MITM. But they don't know that.]

I have no idea why anyone would have downvoted this; it seems basically accurate.

Chains of trust can't defend you from this. Only certificate pinning. IMO this shows why self signed is the way to go: There are no authorities you can trust.

Self signed is indistinguishable from "China is MITM'ing you".

We agree about pinning.

As pinning becomes more widespread, browsers that support it will become a sort of surveillance network for forged certificates. That's effectively what caused the Turktrust discovery.

It would be different if it worked like ssh, where key changes are warned about after the (optional) leap of faith.

The SSH model for SSL is a non-starter, because you can MITM bankofamerica.com or Gmail for an hour and find tens of thousands of people who just reinstalled Windows, bought a new iPad, etc etc, and they will fall instantly to your MITM attack. (And -- more's the hilarity -- if they try to go back to bankofamerica.com tomorrow it will look like the bank is trying to MITM them.)

The new ssl pinning proposals work very similarly to ssh. When the user visits an https site with pinning enabled, the browser will remember the server's public key similar to ssh's known_hosts.

You're correct that this won't protect against a MITM during this first visit and will cause confusion if an attacker pins his fraudulent public key. However, I would argue that pinning provides a large net security gain in practice. The same model of vulnerable initial visit but secure subsequent visits is used in HSTS to prevent ssl stripping attacks.

Reply on news.ycombinator.com