Linked by Thom Holwerda on Mon 5th Sep 2011 22:26 UTC
Privacy, Security, Encryption So, people from within Iran have hacked the Dutch company DigiNotar, allowing them to issue fake certificates so they could listen in on Iranian dissidents and other organisation within Iran. This is a very simplified version of the story, since it's all quite complicated and I honestly don't even understand all of it. In any case, DigiNotar detected the intrusion July 19, but didn't really do anything with it until it all blew up in their face this past week. Now, the Dutch government has taken over operational management of DigiNotar... But as a Dutch citizen, that doesn't really fill me with confidence, because, well - whenever the Dutch government does anything even remotely related to IT technology, they mess it up. And mess it up bad.
Thread beginning with comment 488667
To view parent comment, click here.
To read all comments associated with this story, please click here.
Bill Shooter of Bul
Member since:

1) As a website owner, you choose a CA that is used by large companies that your customers would want to use. If they are likely to trust those large websites, they'll be likely to trust al certs signed by the same CA.

2) As a website user, the number of SSL enabled sites that I use are limited to a few, those few do use reputable large CA's. Its actually quite easy, and with minimum side effects. If a site is signed with a ca root you do not allow, you examine the cert closely and determine if its really worth the effort to verify the identity of the website or to use a different website that provides the same features.

2b) Yes, this may be trusting CA's that have just as poor security as DigiNotar's, but reducing the number of ones that you do trust reduces your vulnerabilities, I think. In any case there are CA's that are trusted by browser makers, that I do not trust who also do not sign any certs of any of the websites I use over SSL. Removing them is an obvious choice.

Reply Parent Score: 2

Alfman Member since:

Bill Shooter of Bul,

1 - I think you missed my point. A bank/commerce site can choose whatever CA they want, but it doesn't matter when 99% of their customers (purely made up) have default CAs in their browsers. It may not be the site's fault, but users are never the less vulnerable through the weakest CAs in their browser. There is absolutely nothing you can do as a website owner to protect your users.

2 - That's quite a hassle. Even for people who have the extra time and expertise to do it, it's bad that they'd need to give up their online choices due to shortcomings of HTTPS.

2b - Even if we assume that it's possible to audit the internal security of a CAs in a comparatively meaningful way, that knowledge is not really public. I certainly can't tell if vendor X is more secure than vendor Y, so on what basis should I white/black list them? Popularity?

So, I don't think it's reasonable or helpful to ask normal users to manage their own CAs. If anything, CAs should be licensed and audited to ensure some kind of compliance with security protocols. Better yet, transition to technologies which take third party CAs out of the loop.

Edit: I guess another possibility would be to change HTTPS validation to require two valid certificates from two independent CAs. This would significantly reduce the attack windows when one CA is compromised.

This would be pretty good from a security robustness standpoint...I don't think it'd be popular though.

Edited 2011-09-06 21:52 UTC

Reply Parent Score: 2

Bill Shooter of Bul Member since:

Oh, I thought you were asking me what I did, not what Joe computer user people should do.

But for argument's sake,

1)If everyone were to limit their trust to the mythical"good CA's" then yes, it would be a good idea for a website owner to use one of those. All of these points have to assume that is the case, or none of this makes sense.

2)It doesn't have to be individuals, necessary. Browsers are already doing this, although they're doing it quite poorly. It would be better if they had an interface like Adblocker that allowed you to choose from some preconfigured list of ca's. Yes, this is trusting other people to trust Ca's who trust websites. Which is a lot of trust going around, but I actually think it would be better.

2b)Yes, Popularity with big trustworthy sites. I trust large websites who have good security minds to select their CA roots. Other people should too.

Edit Comment:
That would be an improvement, but would require CA's to work together.

Reply Parent Score: 2

Lennie Member since:

"Even if we assume that it's possible to audit the internal security of a CAs in a comparatively meaningful way, that knowledge is not really public."

Every CA in the browser has to have a frequent audit to check if they still comply with the rules set out by the CAB-forum (CAB is Certification Authority/Browser Forum).

An external party comes in ones or twice a year and checks if they abide by the rules.

This is like a notary* they check if you have procedures in place to do all the tasks that are required.

But that is all they do, they do not check any technical stuff, just rules and procedures.

I think there is one organisation which does most of those, maybe 90%: WebTrust.

I believe, the rules did not say anything about transparancy and disclosure of breakins. Not even to the members of the CAB-forum.

* Ironically the organisations that started this discussion is called DigiNotar

Reply Parent Score: 2