Electronic Frontier Foundation staff technologist Peter Eckersley has a good, in-depth analysis of the revelation that Iranian hackers acquired fraudulent SSL certificates for Google, Yahoo, Mozilla and others by spoofing Comodo, a major Certificate Authority. CAs are companies that are allowed to sell cryptographically signed certificates that browsers use to verify their network connections; with these spoofed certs, the hackers could undetectably impersonate Yahoo and Google (allowing them to read mail even if it was being read over a secure connection), the Mozilla certificate would allow them to slip malicious spyware onto the computer of anyone installing a Firefox plugin.
It appears that the fraud was detected before any harm could be done, but Eckersley explains how close we came to a global security meltdown, and starts thinking about how we can prepare for a more successful attack in the future.
Most Certificate Authorities do good work. Some make mistakes occasionally,2 but that is normal in computer security. The real problem is a structural one: there are 1,500 CA certificates controlled by around 650 organizations,3 and every time you connect to an HTTPS webserver, or exchange email (POP/IMAP/SMTP) encrypted by TLS, you implicitly trust all of those certificate authorities!
Iranian hackers obtain fraudulent HTTPS certificates: How close to a Web security meltdown did we get?
What we need is a robust way to cross-check the good work that CAs currently do, to provide defense in depth and ensure (1) that a private key-compromise failure at a major CA does not lead to an Internet-wide cryptography meltdown and (2) that our software does not need to trust all of the CAs, for everything, all of the time.
For the time being, we will make just one remark about this. Many people have been touting DNSSEC PKI as a solution to the problem. While DNSSEC could be an improvement, we do not believe it is the right solution to the TLS security problem. One reason is that the DNS hierarchy is not trustworthy. Countries like the UAE and Tunisia control certificate authorities, and have a history of compromising their citizens' computer security. But these countries also control top-level DNS domains, and could control the DNSSEC entries for those ccTLDs. And the emergence of DNS manipulation by the US government also raises many concerns about whether DNSSEC will be reliable in the future.
California assemblyman Jim Cooper (D-9th) has copy-pasted New York assemblyman Matthew Titone’s (D-61st) insane, reality-denying bill that bans companies from selling smartphones with working crypto on them, introducing nearly identical measures in the California legislature.
Trumpscript — a python variant — only allows numbers over 1,000,000; has no import statements (all declarations must be homegrown); only has integers because floating-point numbers are un-American (America never does anything halfway); only allows popular words and the names of politicians as variable names; limits error messages to direct Trump quotes; and requires that […]
“Radical ecology” has come to mean a kind of left-wing back-to-the-landism that throws off consumer culture and mass production for a pastoral low-tech lifestyle. But as the brilliant science journalist and Marxist Leigh Phillips writes in Austerity Ecology & the Collapse-Porn Addicts: A Defence Of Growth, Progress, Industry And Stuff, if the left has a future, it has to reclaim its Promethean commitment to elevating every human being to a condition of luxurious, material abundance and leisure through technological progress.
You travel around a lot. It might be that jet set life from New York to LA to London to Tokyo, or it might be back and forth from the coffee shop to the office, or from the kitchen to the couch. Any which way, you’re mobile and that’s the way to live. When you […]
It’s 2016 and we like our technology really small. Our phones fit in our pockets, our remotes are lighter than ever, and even our cars seem to be shrinking. So your new drone shouldn’t be an exception. This Axis VIDIUS Drone is 21% off right now and it’s so little, your biggest problem won’t be […]
You’ve heard the news: cyber security is the new and very scary frontier. Hackers are out there just waiting for you to relax for a second and let them in. But that’s not going to happen to you. With a lifetime premium subscription to ZenMate VPN, you’re completely protected from anyone out there who wants […]