[PLUG-TALK] Web Certificate System Cracked

[Russell Senior]

>>>>> "Daniel" == Daniel Pittman <daniel at rimspace.net> writes:

Daniel> On Sun, Sep 11, 2011 at 15:01, Rich Shepard
Daniel> <rshepard at appl-ecosys.com> wrote:


Rich> about an Iranian cracker who stole certificate authority from
Rich> three issuers.  The Dutch site must be running Microsoft
Rich> because, the article reports, "The companyâ  s critical servers
Rich> contained malicious software that should have been spotted by
Rich> antivirus tools, the report said, and the servers related to
Rich> certificates were all protected by just one weak
Rich> password. DigiNotar did not respond to requests for comment last
Rich> week."

Rich>   I'm sure those of you professionals who understand this corner
Rich> of the 'Net will have valuable insights into this situation. I
Rich> look forward to reading your comments.

Daniel> For what it is worth, I regard it as a very public
Daniel> confirmation that the current threat model behind the SSL/CA
Daniel> system is, indeed, wrong.  It wasn't a surprise to me, not
Daniel> because I had any notion of the specifics, but because it is
Daniel> absolutely the obvious failure mode for a system that trusts
Daniel> every CA equally.

Daniel> See also the "should we add the Chinese Government CA to
Daniel> Mozilla" discussion.
Daniel> https://freedom-to-tinker.com/blog/felten/mozilla-debates-whether-trust-chinese-ca
Daniel> is useful on that topic, and on the general risk around the
Daniel> model.

Yeah, or the FBI/CIA/NSA and a cooperating CA and you don't have
private end-to-end anymore, because your browser trusts the listed CAs
implicitly to validate certificates and the corrupt CA has just sold
you down the river.

I watched an interesting talk about this recently, where the fellow
suggested that we should invert the trust model, so instead of the server
deciding which CA to use and all users trusting any CA, the user would
decide who can validated a cert, maybe multiple at once, which would
make the MITM thing a lot harder.

 http://www.youtube.com/watch?v=Z7Wl2FW2TcA


-- 
Russell Senior, President
russell at personaltelco.net