TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Let’s Take Back The Certificate Authority

21 点作者 mephux超过 11 年前

5 条评论

reaperhulk超过 11 年前
I ran the technical side of a global CA for 5 years (left the industry early this year) and I can tell you that while validation (outside of EV) is relatively simple, the technical&#x2F;legal&#x2F;audit aspects add up to a significant cost.<p>If you want to run a CA you need to obtain sufficient funding (on an ongoing basis, these aren&#x27;t all one-time costs) to do things properly. Properly means expensive audits, expensive HSMs, expensive secure rooms with multi-factor authentication to enter, auditing of all actions, long-term record retention, reliable and performant OCSP responders, endless documentation (DR, secure hardware lifecycle policies, etc), being an active member of the CABForum to drive your agenda and keep abreast of changing industry requirements, and much, much more. Of course, by doing so you are attempting to upend a multi-billion dollar industry, so expect a political fight with the CAs and potentially the browsers as well...<p>These problems are part of what lead people to prefer replacing the industry (DANE, Convergence, TACK) over building a non-profit CA in the existing model. Of course, replacement comes with its own huge set of obstacles.<p>All that said, if you&#x27;re a company with a bunch of money you want to spend on this problem, let me know. I am willing to lend a hand.
jackweirdy超过 11 年前
I disagree with this completely. The CA Model is absolutely flawed, and this is just patching a flawed model. I&#x27;d love to see a push for [DANE](<a href="https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;DNS-based_Authentication_of_Na...</a>) - where you publish your public key in DNS. When doubled with DNSSEC, this means your IP address is irrefutably tied to your domain and so is your TLS public key.
评论 #6423550 未加载
评论 #6423733 未加载
sehrope超过 11 年前
A lot of folks don&#x27;t realize this but it&#x27;s not just web browsers that you need to worry about. When your app connects over SSL to any service that it&#x27;s consuming you need to be properly authenticating the remote server. For external HTTP requests (ex: to an external REST services) many programming languages&#x2F;environments piggy back on the host machine&#x27;s list of trusted roots (ie. the same ones that your browser uses) but a lot do not. They may just skip over the authentication piece of the SSL handshake.<p>This is <i>especially</i> true for database drivers. If your database driver includes a &quot;use SSL&quot; flag but you&#x27;re not actually specifying a pre-shared certificate to authenticate the remote server then it&#x27;s probably not authenticating the remote server[1]. Think about that for a second ... How would it?<p>I wrote about this a little while back[2] and gave a talk that went into this in a bit more detail this week (slides should be up next week). The gist of it is that if you don&#x27;t authenticate the remote server (by authenticating its SSL cert) you&#x27;re vulnerable to a MITM attack <i>every</i> time you connect. Not just the first time, <i>every time</i>. With SSH we&#x27;re used to pinning remote host keys the first time you connect but with SSL there&#x27;s no such thing[3] and you have to be careful to handle it properly.<p>[1]: I say &quot;probably&quot; here because it&#x27;s technically possible that your remote server has an SSL certificate that is signed by the same set of trusted CAs that you use for HTTP requests <i>and</i> your DB driver actually validates it but it&#x27;s not likely. Most database SSL certificates are either self-signed or self-signed via a CA signing cert controlled by a DBaaS. For example for RDS, Amazon signs the SSL certificates for all MySQL databases with a single CA signing cert: <a href="http://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_MySQL.html#MySQL.Concepts.SSLSupport" rel="nofollow">http:&#x2F;&#x2F;docs.aws.amazon.com&#x2F;AmazonRDS&#x2F;latest&#x2F;UserGuide&#x2F;CHAP_M...</a><p>[2]: <a href="http://blog.jackdb.com/post/55178133114/using-self-signed-ssl-certificates-with-jackdb" rel="nofollow">http:&#x2F;&#x2F;blog.jackdb.com&#x2F;post&#x2F;55178133114&#x2F;using-self-signed-ss...</a><p>[3]: No reason there couldn&#x27;t be SSL cert pinning and it&#x27;s something we&#x27;ve considered for our product. However you can&#x27;t really automate it (you need a user to say &quot;this is okay...&quot;) so we decided to have it be a manual step that you can just click to fetch&#x2F;import: <a href="http://blog.jackdb.com/post/55349902000/auto-importing-ssl-certificates-into-jackdb" rel="nofollow">http:&#x2F;&#x2F;blog.jackdb.com&#x2F;post&#x2F;55349902000&#x2F;auto-importing-ssl-c...</a>
comex超过 11 年前
Doesn&#x27;t this already exist in the form of CAcert?
评论 #6424064 未加载
评论 #6424069 未加载
anon1385超过 11 年前
How does this proposal compare to TACK: <a href="http://tack.io" rel="nofollow">http:&#x2F;&#x2F;tack.io</a> ?
评论 #6423851 未加载