Hacker News Reader

Comment by ctz | Hacker News Reader

If you are careful when generating your certificate (that is, careful to generate a subject certificate, and not a CA certificate) and can reliably distribute your certificate to all clients you are interested in, then self-signed certificates are usually much better than the public CA system.

But actually achieving the pre-distribution step is pretty hard, and basically impossible over the internet. You can achieve it pretty well in a business setting, where you can push your certificates to all the clients through AD, MDM, or similar.

Sidenote: You should also take this opportunity to appreciate how dismally mis-designed web transport security is:

* Cleartext, unauthenticated: just works, no warnings.

* Encrypted, unauthenticated: THE SKY IS FALLING.

* Encrypted, authenticated: little padlock.

View on HN

A site claiming to offer cryptographic security when it is in fact not is, in reality, worse than a site that simply doesn't offer cryptographic security. Both those sites --- the SSL site and the non-SSL site --- aren't offering security. But only one of them is also being deceptive about it.

However, you'll get no argument from me if you constrain your argument about dismal mis-design to browser UI/UX. The browser UX design for TLS security hasn't meaningfully changed since Netscape.

Unauthenticated SSL does provide security against passive attackers, which is what mass surveillance in developed countries is. If the NSA ever insists on widespread MITM of connections, we have much bigger problems.

I agree the UI needs to be properly worked out so that eg a bank can't be downgraded to an unauthenticated certificate.

I don't understand why they don't just use different colors for self-signed SSL connections.

CA-signed: Green lockpad

Self-signed: Yellow lockpad, with question mark superimposed over it

Regular HTTP: Orange, no lockpad (insecure)

Invalid or revoked cert: Red, "stay away" displayed within <blink> tags.

The current UI that most browsers present implies that self-signed certificates are worse ("scarier") than regular HTTP, which is not true.

Well, it's not really a continuum. 'There should be only one mode, secure' and all that - asking users to make ad-hoc security assessments is generally a bad idea. In an ideal world, plaintext HTTP wouldn't exist and everyone would have a key delegated by their domain registrar.

No lock would suffice for unauthenticated https; those that find the distinction meaningful can investigate the URL. But then you still risk someone bookmarking https://example.com and suffering a downgrade attack from not paying attention to color changes.

The best way forward is probably the creation of a new protocol designator (httpz or something) that is SSL using the SSH key model. But there's no impetus to do this as it's easy enough to pay the CA tax and be on your way with unquestioned "full security".

I'd love to see something like SSH, you trust the self-signed certificate the first time, and then it's considered valid until it changes (but it should get treated differently from CA-signed certificates, your yellow padlock idea is great).

Then warn the user if the certificate ever changes.

I think this is a good idea. It could be combined with a system similar to HSTS so banks could protect against MITM attacks.

That's the whole point: There's no way to determine "unauthenticated" SSL versus MITM SSL. Once you have that "worked out" then you've solved the issue of self-signing in the first place.

I think I have a good idea to solve this. What if a system similar to HSTS was implemented? https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security important sites (banks) could send a "don't allow self signed certs" header. Browser UI could change to educate users not to type personal information into self signed sites.

... Then an attacker MITMs the bank with a self-signed cert, and strips the "don't allow self-signed certs" header. Such a header would be literally useless.

HSTS already allows self-signed certificates, if the certificated is validated out-of-band.

But if a site is self signed the browser could show something like "This site is not authenticated, don't enter any personal info/passwords"

I think if you try to responsibly design this feature in browser UI, you'll end up with the same problem.

User requests an HTTPS resource, which means the connection must be secure. The UA is unable to establish a secure connection, just as if a MITM attack was underway.

So, now, the user has just entered https://facebook.com. Currently, when this secure connection fails, the browser warns the user in no uncertain terms.

Your suggestion would be to what, exactly? Put a small, unobtrusive dot somewhere in the UI indicating "yeah, I know you asked for HTTPS, and I ignored that, but I didn't wanna really bother you"?

If you're responsible for user's safety, which may depend on the UA treating HTTPS as it should, then you've just betrayed your user.

And at any rate, by not aborting while verifying the certificate, you're already leaking potentially personal information: The URL, cookies, etc. So if you treat the user's data with respect, you don't go sending that insecurely after the user requested HTTPS.

And if you can't transmit the request, because you need to warn the user... you end up with a UI like browsers have.

Right. It is questionable why self-signed certificates trigger scary warnings in browsers when totally unencrypted connections do not.

I think the whole UI aspect of web transport security needs re-thinking.

It's pretty simple: An unvalidated/unauthenticated certificate looks like a MITM. Requesting an HTTPS resource indicates you want a secured connection. If the certificate is not trusted, then you don't have a secure connection.

The criteria is not self-signed, it's trusted/authenticated or not. Most self-signed certs are not trusted, and solving that solves the CA problem. But if a self-signed cert is trusted then browsers happily display the secure UI without any errors.

The idea behind HSTS is that the proper server commits to something for a significant period of time, making the later MITM fail.

In response to your previous post, the idea is that the user has to take some responsibility for their security (we can't stop them from entering their bank credentials into a friendly form on www.phish.com either), through a UI that makes it clear that the identity of the server is unauthenticated.

You have a point here. Perhaps the real solution is that we should make the browser throw a fit when someone tries to input a "password" into a page/authdialog that has no security as well.

Then the altered page just specifies that it is not a password field, and emulates it with javascript or whatever. So that could only work for sites where a password manager was used, assuming the user doesn't just go ahead and type it in themselves.

Not just passwords, any form submission. :P

you could simulate forms with JS and images. You dont even need to submit, once a user fills the form exfiltrate it through a JS image load, such as this http://www.lanmaster53.com/2011/05/stealth-cookie-stealing-n...

> If you are careful when generating your certificate (that is, careful to generate a subject certificate, and not a CA certificate) and can reliably distribute your certificate to all clients you are interested in, then self-signed certificates are usually much better than the public CA system.

Indeed, and the blockchain (combined with a proxy like DNSChain), can be used to do this securely and for free at-scale.

> Encrypted, authenticated: little padlock.

Neither self-signed nor CA-signed certificates are securely authenticated, so the padlock is completely misleading.

See this comment for details: https://news.ycombinator.com/item?id=7826443

Could whoever down-voted that please explain why you did so?

Wasn't me but I wonder about this: "Neither self-signed nor CA-signed certificates are securely authenticated...".

I'm no expert on CAs but saying their certs are not securely authenticated is worrying. Seems to defeat their purpose, no? Maybe expand on that point if you can as I don't understand how it can be true.

Did you read the comment I linked to where I provided those details?

Here it is again: https://news.ycombinator.com/item?id=7826443

And if you want a longer version of that, you can go here: http://blog.okturtles.com/2014/02/introducing-the-dotdns-met...

> I'm no expert on CAs but saying their certs are not securely authenticated is worrying.

Yes. I'm glad we agree on that. :P

yes, this is my biggest problem with my favorite browser... why does Firefox do this? (Encrypted, unauthenticated: THE SKY IS FALLING.) edit: this is probably part of a NSL...

Reply on news.ycombinator.com