Http://www.google.com/wo0dh3ad

Re:Http://www.google.com/wo0dh3ad by varjag on Friday January 07, 2011 @07:04AM (#2079319)

So what you are trying to convey, there is no advantage to using SSL vs. plain connection? I wonder why then they shut down SSL in my home country during elections..

[ Parent | on HN ]

Re:Http://www.google.com/wo0dh3ad by skorgu on Friday January 07, 2011 @10:26AM (#2079763)

There's no advantage against a motivated, state-sized actor. Against other attackers there is still substantial advantage.

[ Parent | on HN ]

Re:Http://www.google.com/wo0dh3ad by varjag on Friday January 07, 2011 @10:36AM (#2079791)

Let's say there is no advantage against (maybe) the U.S. government. I fail to see how any other state or entity would be able to manipulate certificate authority chain in general.

[ Parent | on HN ]

Re:Http://www.google.com/wo0dh3ad by mooism2 on Friday January 07, 2011 @10:49AM (#2079831)

If you are a certificate authority, you can issue certificates for any domain. There is nothing in the technology preventing you from issuing a whitehouse.gov certificate merely because you are based in Iran, for example.

[ Parent | on HN ]

Re:Http://www.google.com/wo0dh3ad by varjag on Friday January 07, 2011 @12:07PM (#2080115)

Who is going to sign it?

[ Parent | on HN ]

Re:Http://www.google.com/wo0dh3ad by mooism2 on Friday January 07, 2011 @12:35PM (#2080230)

Who is going to sign what?

If you mean the certificates that the certificate authority issues, then the certificate authority signs them itself.

If you mean who signs the certificate authority's authority certificate, then either another certificate authority signs it, or the certificate authority signs it itself and pays the browser makers to include it as a root certificate in their browsers.

I'm not sure what you're trying to get at?

[ Parent | on HN ]

Re:Http://www.google.com/wo0dh3ad by varjag on Saturday January 08, 2011 @09:40AM (#2083096)

What is the chance of Iran becoming a root CA? Passing a WebTrust audit? It's not like you can become one just by showing up.

[ Parent | on HN ]

Re:Http://www.google.com/wo0dh3ad by mooism2 on Saturday January 08, 2011 @11:40AM (#2083306)

Etisalat (state-controlled telecoms company in UAE) is a certificate authority. They are not a root CA --- Verizon signed their CA certificate. They have used this capability to intercept SSL communications.

If a UAE state-controlled telecoms company can become a CA, why not an Iranian state-controlled telecoms company? Or Chinese?

[ Parent | on HN ]

Re:Http://www.google.com/wo0dh3ad by jrockway on Friday January 07, 2011 @04:42PM (#2081242)

You are. You are the certificate authority, and you're trusted. Anything you sign is, by definition, valid.

[ Parent | on HN ]

Re:Http://www.google.com/wo0dh3ad by varjag on Saturday January 08, 2011 @09:42AM (#2083098)

Except every browser I know will barf at self-signed cert.

[ Parent | on HN ]

Re:Http://www.google.com/wo0dh3ad by jrockway on Saturday January 08, 2011 @11:06PM (#2084767)

Not when you are a certificate authority that is already trusted by the browsers.

Modern browsers today accept a large number of "self-signed" certificates. The key is that the signer paid the browser makers money for that privilege. SSL assumes that those companies are all trustworthy, but is any company trustworthy when the government shows up with guns and asks for the master password to your key signer?

If no, then SSL fails.

Let me summarize because you seem to be misunderstanding: a lot of untrustworthy parties are trusted by browsers. This makes SSL somewhat useful against having a coffee shop steal your Facebook password, but almost certainly useless against having a government steal your password.

[ Parent | on HN ]