undefined | Better HN

0 pointsocdtrekkie6y ago0 comments

And it fails to be useful without a way to tie it to a brick-and-mortar entity, aka, EV. Which is my point. That was exactly what PKI could bring to the table.

0 comments

5 comments · 2 top-level

tptacek6y ago· 3 in thread

Either you're not understanding me or I'm not understanding you. I'm making a simpler point: some kind of authentication does indeed have to happen in TLS. Without it, TLS provides essentially no security.

ocdtrekkieOP6y ago

I'm saying in a world where equifaxsecurity2017.com is a real domain, and securityequifax2017.com is a fake one that the real Equifax Twitter account posted[1], domain authentication is not authentication at all. As such, without EV, TLS provides essentially no security, correct.

And even for well-known domains, https://www.xn--80ak6aa92e.com/ (currently still works in Firefox) is an excellent example of why domain validation remains completely useless.

[1] https://money.cnn.com/2017/09/20/technology/business/equifax...

tptacek6y ago

Your complaint is about phishing. I agree that phishing is too easy. But that concern is orthogonal to (and significantly harder than, both technically and from a policy perspective) reliably encrypting the TLS transport.

This is one of the older controversies on m.d.s.policy, for whatever it's worth to you.

I don't really care where you or anyone else comes down on this, as long as we all agree that you can't just jettison certificates and let HTTPS "just provide encryption", which is a common HN refrain and is clearly unsound reasoning.

1 more reply

eridius6y ago

> And even for well-known domains, https://www.xn--80ak6aa92e.com/ (currently still works in Firefox)

How is it that this still works in Firefox? It's been fixed for years in all other major browsers. I'm seriously shocked that Firefox still allows IDN homograph attacks.

wolf550e6y ago

TLS only says you're having a private conversation with a server, not how trustworthy it is. Maybe you're having a private conversation with the devil!

TLS protects you from active attacker at your internet cafe wifi or small ISP or not-tier1 country's ministry of propaganda.

If the network between multiple aws/gcp/azure regions where e.g. let's encrypt's acme servers are deployed and the server you're talking to is hijacked, TLS doesn't help because hijacker can get valid certificate.

j / k navigate · click thread line to collapse