Slashdot Mirror

Right.

3 words: tripple entry accounting. If it's successful, bitcoin will be the biggest thing to hit accounting practises and economic stability since the 15th century.

I remember getting flamed something terrible when SSL was first announced and I said at that time there was no way to stop a Man In the Middle Attack.

All sorts of irrelevant counter arguments were made at that time too.

Certificate and DNSSEC are also useless.

Why, because if your using your PC from 1 ISP or your employers fire walled Intranet, then from the time you install a browser on your PC there, nothing can be trusted.

Certificates and DNSSEC would also come from MITM servers.
There firewall could send you bogus certs and then give you valid connections as if they were the real web site. In turn there fire wall could unwrap your encrypted traffic, then repack it in to the real cert for connection to the SSL'ed web site.

Unless you are going to manually install your keys that you brought from a second clean source there is nothing your going to be to be able to even tell that you've been compromised.

So SSL's largest problem is when your sitting at your office in your big corporate job, and it's got the SSL lock, your lulled in to a false sense of security!

I worked for a German Multinational. All net traffic from my US office went through Germany to get on to the net.
I'd find it impossible to believe that if they had wanted to, that they couldn't do a very complete MITM attack.

My solution was to do SSH over SSL, where I'd bring my own SSH keys in on USB Stick.
then I could run X over that SSL to a Firefox running on my own Personal CoLo running Linux.

I could also have done a VPN over SSH over SSL.
Nice thing about these are canned large corporate attacks wouldn't be geared to deal with it.

Problem is everyone arguing about security it thinking hackers and not corporate spying of employees or government spying of foreigners or it's citizens.

I just remember that German Citizen while in the USA had to be given special internet and phone because under German law they weren't allowed to be monitored and because it was a German company they had to be given the same rights as if they were in Germany.

So I'd say it was safe to assume, I wasn't given that special privilege of not being monitored.

On the subject of recorded IP traffic logs, if it's an after some incident, they can put lots of time and money into cracking your encrypted traffic. Some of these Intellectual property law suites can go on for 10 years. You are a fool to think that they wouldn't crack your keys and see everything that you ever viewed over the web while at work.

It's for this reason why I love one time pads, it's a real loss that security people keep dismissing them.

for some interesting reading:
http://iang.org/ssl/
https://www.financialcryptography.com/

Then again, CA-signed certificates also suck. I've already written about it here, so I won't reformulate the problem in this post, but I'll quote the most relevant part:

---

The problem, then, is that this implies that you need to trust Verisign and Thawte to properly validate all the certificate requests that they get—people in an extremely large, bureaucratically weighed-down enterprise that process thousands of certificates daily using automated processes. What are the chances that they wouldn't let one single mistake slip through, and issue a certificate to a cracker for a site that he does not own? The problem does not end there, however: The certificates pre-installed on new PCs are not limited to Verisign and Thawte. They commonly ship with the certificates of around 50 different certificates organizations. Even if you feel secure in trusting Verisign and Thawte (which you should not, but more on that later), what are the chances that all of these can be trusted to consist entirely of incorruptible people and flawless processes? And, even if they did, what are the chances that all of them are completely secure and cannot themselves be cracked to produce faux certificates? For this reason alone, I, for one, would consider the entire process flawed and untrustworthy, and I would implore you to do the same. Therefore, Haven and Hearth uses its own, self-signed SSL certificate, bypassing the certificate authorities. To further clarify our stance, the following three points of policy are noteworthy:

• I do not want to convince you to distrust people. This is a problem of statistics; it would be almost weird if, somewhere in any of the many organizations whose certificates are installed in browsers worldwide, there did not exist anyone who was untrustworthy or just one computer system which is crackable, and the system is designed in such a way that just one is enough to break it.
• Sure enough, there have not been many major security breaches through this route (though it is not unheard of, either), so you might think that I am merely being alarmist, but I would still argue that the flaws in the system is enough reason to boycott it.
• Last, but not least: As I mentioned above, the certificate authorities more often than not charge quite obscene amounts for their services, which emanates an attitude that "The web is for corporations, not for individuals"; a statement that we resent.

But hold on, there is more to this. You may have read the preceding paragraph and still thought it all right to trust all these diverse organizations. However, you really should not: it is well documented that Verisign actively produces faux certificates for various purposes, especially for law enforcement agencies, so that they can perform MITM attacks. You can see Verisign's own home page if you doubt it. What Verisign's faux certificates mean in practice, is that their holder can impersonate any web site, to listen to the traffic between them and their visitors, modify their content arbitrarily and catch any and all sensitive information. And by that, I really mean any web site, not only those with certificates signed by Verisign in the first place. See, when the browser performs its certificate authenticity check, it checks the web site's certificate against any of its installed certificate authorities, and it does not even warn you if the web site's certificate has changed since the last time you visited it, as long as it is signed by just one of the certificate authorities it knows of. Of course, it is not only Verisign which is bestowed with this power – any of the certificate authorities can do th

You can *NEVER* establish identity with a self-signed cert.

That's not actually true, though -- you merely need to exchange the certificate identity beforehand. For example, if you walk into your bank office and ask for Internet banking access, they can give you a physical piece of paper with the correct certificate key fingerprint, which you can then verify manually when you go to your Internet banking website. Which is how cryptographic trust should work.

Gaining trust is subjective, and when you trust an authority, you implicitly effectively incorporate and endorse their verification methods them as your own.

Which is why the current system is not a very good one. Of all the 40+ certificate authorities that ship with any browser, it would be ludicrous to think that at least one of them would not either be untrustworthy or at least vulnerable to attack from real crackers. See Verisign, for example, which issues fake certificates to government agencies.

Therefore, I would argue that self-signed certs (or simply a PGP/GPG-like trust model) is far better than the current SSL scheme, which really can't be trusted at all.

Let's quote what Geotrust says about relying on certificates:

GeoTrust's solution is that the browser should display ... "The name and logo of the CA who issued the certificate. Consumers will soon learn from news reports which CAs to trust and which CAs use sloppy procedures and should not be trusted."

We should take Geotrust at their word. Now that we're certain that their procedures are sloppy and they can't be trusted, their certs should be pulled from all browers. New releases of Firefox should not contain root certs for Geotrust. They had their chance, and they blew it.

Actually, it's even easier than that. All a terrorist has to do to communicate securely is buy a cheap pre-pay mobile phone. Computer security and encryption are basically meaningless next to real-world methods of avoiding detection.

Mohammed was a victim of his own sloppiness, said a senior European intelligence official. He was meticulous about changing cellphones, but apparently he kept using the same SIM card.

Heh... note the email address Annalee Newitz is using here... she evidentally creates a new mail alias for every column: sugarpill@techsploitation.com

Ah, slash ids pushing a billion and whining about what a sewer it's become...