In the wild: Phony SSL certificates impersonating Google, Facebook, and iTunes | Hacker News Reader

In the wild: Phony SSL certificates impersonating Google, Facebook, and iTunes

arstechnica.com

29 pointsghosh13 comments

The root of the problem is inability to pin pubkey directly to a DNS record which is changeable only by the owner of the private key. If there was a single place where any client can check which PK owns which name and trust derived SSL certificates from there, then the end user UI would be simpler and safer altogether.

Suggestion: a protocol to register names on Bitcoin blockchain. You can securely transfer ownership of a name, securely associate more metadata with it etc. Every client can independently check if a given certificate for a given domain name is issued by a proper owner, not by one of opaque organizations that you just have to trust.

Today personal computers are bundled with hundreds of root certificates. If one is compromised by FBI or Mossad, they can impersonate FB or Google no problem. DNS records can be taken from you and/or censored, DNS servers spoofed etc.

Combining SSL with decentralized DNS-on-blockchain is just so logical. BTW, Namecoin is not the best attempt because it requires separate blockchain. People want one, the most powerful, most robust blockchain and we should pin all our metadata right there. The real problem is how to organize socially, how to agree that this particular protocol with that distribution of names is The Name System, while all others are cheap clones.

Just to clarify:

With modern DNS and SSL one of the root issuers can be compromised to impersonate any website. More root certificates - more targets.

With blockchain as a root authority, every website is their own guardian. If Google loses their keys, someone may impersonate only Google, but not Facebook, Twitter or your homepage. In combination with multisignature transactions, Google may lock access to their "BitDNS" records to a board of directors with 3-of-5 vote. If one or two keys are compromised or unavailable, it does not stop the company from moving their property how they want.

Namecoin is the best attempt, because if someone compromises DNS it doesn't immediately have access to real money. The task of maintaining Namecoin would be taken by the current maintainers of the DNS system.

What's so bad about keeping different things separated?

Any bitcoin-like blockchain must be a valuable currency at the core to reward miners with minted units and fees. Otherwise, there's no incentive to deploy petahashes of computing power to secure consensus worldwide. Namecoin is a currency. If it's not valuable, its security is nil. Economically, users want to keep cash in the most liquid (marketable) asset, therefore, users and miners want to converge on a single most powerful blockchain (aka "network effect"). Today it's Bitcoin and it can only change if it's completely replaced for some reason by a superior, even more liquid blockchain.

Also: blockchain does not need to store more than 32 bytes of metadata or have special name-handling features like Namecoin does. You only need to associate 1 satoshi with a 32-byte hash of your metadata (addresses, certificates, private keys etc.) Metadata can be distributed by any means, e.g. by today's network of name servers. Blockchain only works as a proof of name ownership that links that metadata to a name. You can use just 1 satoshi to be allocated for the name. If you lose your name, it'll be worth much more than that anyway.

  You only need to associate 1 satoshi with 
  a 32-byte hash of your metadata (addresses,
  certificates, private keys etc.) Metadata 
  can be distributed by any means, e.g. by 
  today's network of name servers.

If you store the hashes and rely on something else to tell you the metadata, how do you stop people deleting records from the past by deleting or blocking access to the metadata?

For example:

The legitimate owner of www.alice.com creates a DNS record saying "www.alice.com is owned by alice", then puts scrypt("www.alice.com is owned by alice") into the blockchain, then creates a DNS record saying "and the proof of this ownership is transaction e8a2e79eee906 which took place in December 2013".

You're on malicious coffee shop wifi. You don't have anything pinned. You make a DNS request and you get records saying "www.alice.com is owned by eve" and "the proof of this is transaction c8bb5f503dc26820 which took place in January 2014".

How do you find the first, legitimate transaction?

Of course there's incentive to secure consensus! If you don't secure it, you lose your domain name. It's like a registrar, only distributed and (maybe) safer.

I don't understand why this is newsworthy? Everybody could generate an unsigned certificate for any name in just a few seconds. The point is that they are unusable in any sane browser.

In browsers, yes, but what about apps? Search StackOverflow for e.g. "ssl ignore server certificate" and despair...

That's not enough for some people. A somewhat stronger version would be to do PK pinning. But the consequence can be annoying and painful.

--EDIT-- Opps they did mention PK pinning as a solution. Cool.

Pinning is still a joke, years after multiple known instances of malicious certificates in the wild. When will Firefox actually implement pinning in the browser itself, instead of via some random add-on?

Supposedly Google pays Mozilla $300m/yr. If we can accept that astronomical number, then WTF happens to all that money? Trivial FF changes like moving tabs above the address bar. But useful improvements like pinning languish.

It's difficult to do, that's why. Pinning a certificate relies upon trusting someone. But who do you trust, and how do you decide upon a basis to trust them?

With Chrome, the answer is easy. Google control the browser code, so you're implicitly trusting them anyway, and they're vouching for the certificates to their own sites, so you have good reason to accept what they say are the real certs.

With Firefox, the picture is much more hazy. The certificates being pinned aren't owned by Mozilla (at least, for the functionality to be useful you want to pin certs from other places, unless you browse mozilla's website all day long). So someone at Mozilla has to vouch for a 3rd party's certificate. Why should we trust Mozilla at this? How would Mozilla decide who to trust when they say 'honest, this really is my certificate'? And even if we accepted mozilla's judgement, all this does is make them an authority. You know, like all those other certificate authorities that already do this job. So nothing will have changed and nothing will have been improved.

Essentially all these systems depend on maintaining the security of a private key which can be compromised in the same way as a client side password. DNS should be something that can give persistent assurance even if a site is compromised in the short term. If you give complete trust to the private key, you then need some kind of revocation scheme to remove that trust when it is compromised. Who runs the revocation list, and how do you authenticate the person revoking the certificate?

The challenge is really to encourage offline authentication of DNS and SSL certificate changes. It should be something that can be put in a safe and requires physical attack to circumvent. Something permanent enough that loss would be unlikely, and would result in permanent revocation of the domain.

SSL pinning on iOS is now very easy. AFNetworking 1 supported it and AFNetworking 2 has made it a great deal easier.

Pinning by public key means makes upgrades and certificate renewal less of a problem.

Reply on news.ycombinator.com