Linked by Thom Holwerda on Mon 5th Sep 2011 22:26 UTC
Privacy, Security, Encryption So, people from within Iran have hacked the Dutch company DigiNotar, allowing them to issue fake certificates so they could listen in on Iranian dissidents and other organisation within Iran. This is a very simplified version of the story, since it's all quite complicated and I honestly don't even understand all of it. In any case, DigiNotar detected the intrusion July 19, but didn't really do anything with it until it all blew up in their face this past week. Now, the Dutch government has taken over operational management of DigiNotar... But as a Dutch citizen, that doesn't really fill me with confidence, because, well - whenever the Dutch government does anything even remotely related to IT technology, they mess it up. And mess it up bad.
Thread beginning with comment 488658
To view parent comment, click here.
To read all comments associated with this story, please click here.
Bill Shooter of Bul
Member since:

You raise some good points. I would be in favor of a better system that wouldn't allow any trusted CA to issue a cert for any site.

Given the current system that we have, the best bet is to restrict the number of CA's that you trust.

Reply Parent Score: 2

Alfman Member since:

Bill Shooter of Bul,

"Given the current system that we have, the best bet is to restrict the number of CA's that you trust."

Well yes, but that only applies to what you can control. There are problems with managing CA's personally:

1. As a website owner, your choice of CAs doesn't increase your security. The authentication of your website is validated by the list of CAs in your user's web browsers.

2. As a user, it's reasonable to want to trust only specific CAs where I can attest to their security. However in reality real websites will use CAs who's security I cannot attest to. So, this may not be an option.

2b. Obviously you're talking about blacklisting a select group rather than whitelisting a select group. But the problem remains that you are trusting CAs who's security procedures haven't really been attested to and could in fact be as bad as DigiNotar.

I'm not even sure how bad DigiNotar's procedures actually were. All CAs are vulnerable to things like zero day exploits and disgruntled employees even when they do follow best practices.

Reply Parent Score: 2

Bill Shooter of Bul Member since:

1) As a website owner, you choose a CA that is used by large companies that your customers would want to use. If they are likely to trust those large websites, they'll be likely to trust al certs signed by the same CA.

2) As a website user, the number of SSL enabled sites that I use are limited to a few, those few do use reputable large CA's. Its actually quite easy, and with minimum side effects. If a site is signed with a ca root you do not allow, you examine the cert closely and determine if its really worth the effort to verify the identity of the website or to use a different website that provides the same features.

2b) Yes, this may be trusting CA's that have just as poor security as DigiNotar's, but reducing the number of ones that you do trust reduces your vulnerabilities, I think. In any case there are CA's that are trusted by browser makers, that I do not trust who also do not sign any certs of any of the websites I use over SSL. Removing them is an obvious choice.

Reply Parent Score: 2