News for hackers. Stuff that matters.

A comment on Show HN: CryptoNote is an open source, encrypted, one time view message app. Parent comment

Re:Show HN: CryptoNote is an open source, encrypted, one tim... by uh_oh on Friday June 07, 2013 @03:30PM (#5841092)
No, he can't. Not without a valid SSL certificate for cryptonote.org. Sure, there are problems with CAs, but it would nevertheless be very difficult to obtain such a certificate.
[ Parent | on HN ]
Re:Show HN: CryptoNote is an open source, encrypted, one tim... by mindcrime on Friday June 07, 2013 @03:51PM (#5841225)
but it would nevertheless be very difficult to obtain such a certificate.

Not if you're the government. Just send the root CA a "National Security Letter" and bob's yer uncle.

[ Parent | on HN ]
Re:Show HN: CryptoNote is an open source, encrypted, one tim... by uh_oh on Friday June 07, 2013 @04:35PM (#5841617)
We were are talking about a random guy in front of the house, not the government.
[ Parent | on HN ]
Re:Show HN: CryptoNote is an open source, encrypted, one tim... by mindcrime on Friday June 07, 2013 @04:40PM (#5841658)
But the set of "random guys" who might appear in front of your house includes potential government agents.
[ Parent | on HN ]
Re:Show HN: CryptoNote is an open source, encrypted, one tim... by lmm on Friday June 07, 2013 @05:55PM (#5842224)
No, they're nonrandom. And more to the point, it's worth defending against some threats even if you can't cover all.
[ Parent | on HN ]
Re:Show HN: CryptoNote is an open source, encrypted, one tim... by yk on Friday June 07, 2013 @06:15PM (#5842377)
He can put his root CA into the browser, certainly when the browser is first installed, and perhaps with the next update. (Are automatic browser updates encrypted?)

But this is besides the point of in browser crypto. The interesting thing is, you need a reliable delivery platform for your crypto code, but this implies you have a TLS connection. So either a third party can break your TLS and modify the crypto code, or your connection is secure in the first place. The scenarios you are then dealing with, is that the server is potentially malicious, but a malicious server just serves broken crypto.

[Edit spelling]

[ Parent | on HN ]
Re:Show HN: CryptoNote is an open source, encrypted, one tim... by jlgreco on Friday June 07, 2013 @03:32PM (#5841110)
Or (in enough cases to be a valid concern), not without using sslstrip. Which is trivial.
[ Parent | on HN ]
Re:Show HN: CryptoNote is an open source, encrypted, one tim... by uh_oh on Friday June 07, 2013 @04:33PM (#5841604)
If you are the recipient of the link, SSL can't be stripped.

Even if you are an author, assuming you have visited the site over SSL at least once, then it can't be stripped on future visits since the site seems to use HSTS.

[ Parent | on HN ]
Re:Show HN: CryptoNote is an open source, encrypted, one tim... by jlgreco on Friday June 07, 2013 @05:18PM (#5841982)
It is trivial to strip links being sent to a user over unsecured channels.

There are many things that can mitigate an sslstrip style attack, but coverage from those things is patchy.

[ Parent | on HN ]