Comment by kensey
16 hours ago
The big takeaway here is: Web PKI is fundamentally broken, and the existence of CAs as a concept is the vulnerability that must be fixed -- or, more specifically, the idea that ultimately trusting a relatively small, basically fixed/hard-to-change set of (mostly) commercial entities with something this critical and far-reaching is (or ever was) actually a good idea.
There are a lot of reassuring statements from browser makers and others about how their mitigations for exactly this scenario kicked in and protected (some set of) Internet users, but IMHO there is not nearly enough discussion happening about fixing things so those mitigations are not needed to begin with.
People have been saying that CAs are a bad idea since CAs were first proposed.
The problem is that those same people tend to disappear as soon as you ask "So what should we do instead?"
I think Moxie's "convergence" proposal from ~2011[1] has the most benefits with the least downsides -- in particular I think he really pointed out the crux of the issue: the fact that servers decide who is trustworthy enough to certify their certificates and clients have no input into that decision is a broken model.
This incident was obviously comically bad but the Comodo hack had a more painful impact on the mitigation that should give everyone pause -- their CA had signed a quarter of the internet's certificates so the trust couldn't just be revoked. Imagine one of the LetsEncrypt intermediates got compromised -- our mitigation strategies really cannot cope with that kind of disaster scenario. Browsers would be in the unenviable position where they'd be forced to make huge portions of the internet go dark for potentially months.
[1]: https://en.wikipedia.org/wiki/Convergence_(SSL)
For starters, limit CAs to a specific scope. It's pretty insane a Chinese or Indian CA can certify websites in the Netherlands.
In the 90s vision of a truly globalised world that might have made sense but in today's geopolitical reality it's insane.
If this had been in place already, instead breaking the internet this would have been purely a regional issue.
oh no you want some trendy .in or other domain name? sorry can't use your favorite CA, got to use the crappy one that leaked keys
3 replies →
We should have a very small set of largely not-for-profit CAs run by competent security people, such as Let's Encrypt. There are just too many trusted CAs at the moment, it increases the risk of a breach like this substantially.
Let's Encrypt had their own security snafu. They issue certificates for longer than they were supposed to (1 extra second). It wasn't as big of an issue as this, but let's not act like they are some silver bullet
https://bugzilla.mozilla.org/show_bug.cgi?id=1715455
You could store the public key for each website in DNS. But now you moved the trust problem to DNSSEC. So far I haven't heard about issues like this for DNSSEC, but then again it is not a massive target currently.
The largest problem is that you trust the entire set of commercial entities (in any one of them can destroy the world's security by itself), and the set is semi-secret (in no party using them actually knows what the set is).