With the all of the activity circling around SSL certs and CA trust, there is an inherent trust problem. Internet users have been taught to trust the PKI scheme that we use for all secure browsing activity. There are two very valid cases for the destruction of this trust:
1. Law-enforcement / Government interception. There are product vendors whose business model is to supply equipment to law enforcement and government clients which can "law-fully" intercept communications without the knowledge of the end-user. Example is www.packetforensics.com. Although I do not have a link (can anyone supply a corroborating link?), there are several product pages that are not publicly accessible which would likely confirm this fact. In order for these products to work, the SSL certs that are used would have to be trusted by the browser software to avoid being detected as un-trusted. I am theorizing that these certs would be generated by one of the trusted roots within the existing trust-model.
2. Compromised CAs. Both Comodo and Diginotar both purport to have been compromised resulting in the generation of certificates that can be used to emulate the trust with popular web properties. To the end user there is no easy way to differentiate between valid and invalid certs.
The impact here is that a user may think that all information is secured between them and the server, but in reality this traffic may be routed through a very-untrusted 3rd party and intercepted. We currently have no effective tool to provide information to users that any activity like this has occurred. So for the mean time we should be very vigilant about who we are communicating with, and the certificates that are used to trust their identities.
I also encourage and hope that we see some innovative solutions created that will allow users to be aware of changes to traffic patterns - indicating potential MITM, and new methods of generating trust in web-services like convergence http://convergence.io/.
1. Law-enforcement / Government interception. There are product vendors whose business model is to supply equipment to law enforcement and government clients which can "law-fully" intercept communications without the knowledge of the end-user. Example is www.packetforensics.com. Although I do not have a link (can anyone supply a corroborating link?), there are several product pages that are not publicly accessible which would likely confirm this fact. In order for these products to work, the SSL certs that are used would have to be trusted by the browser software to avoid being detected as un-trusted. I am theorizing that these certs would be generated by one of the trusted roots within the existing trust-model.
2. Compromised CAs. Both Comodo and Diginotar both purport to have been compromised resulting in the generation of certificates that can be used to emulate the trust with popular web properties. To the end user there is no easy way to differentiate between valid and invalid certs.
The impact here is that a user may think that all information is secured between them and the server, but in reality this traffic may be routed through a very-untrusted 3rd party and intercepted. We currently have no effective tool to provide information to users that any activity like this has occurred. So for the mean time we should be very vigilant about who we are communicating with, and the certificates that are used to trust their identities.
I also encourage and hope that we see some innovative solutions created that will allow users to be aware of changes to traffic patterns - indicating potential MITM, and new methods of generating trust in web-services like convergence http://convergence.io/.
Comments