this post was submitted on 02 Oct 2024
37 points (100.0% liked)
Privacy
789 readers
2 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
New to me that https is broken
HTTPS doesn't stop them from knowing what you visited. It just stops them from knowing what you did while you were there. VVPN provider can still see that you visited Google, but they cannot see what you asked for Google to do for you.
Yes. Not claimed otherwise. OC claimed that they see what you are doing which is wrong.
You can read more about this learning about X.509.
Its the PKI thats broken, namely the root stores. Has been unreliable for many, many years. This is why packages are signed.
So you are basically saying that root CAs are unreliable or compromised?
The great thing is, that you can decide on your own which CAs you trust. Also please proof that those are actively malicious.
And no. That is not the reason that packages are signed, i am guessing you mean packages like on linux, packages contained in the installation repository. The reason is, that you build another chain of trust. Why would i trust a CA which issues certificates for domains with code distribution. That's not their job.
Not exactly. They are pointing out that HTTPS assumes all is well if it sees a certificate from any "trusted" certificate authority. Browsers typically trust dozens of CAs (nearly 80 for Firefox) from jurisdictions all over the world. Anyone with sufficient access to any of them can forge a certificate. That access might come from a hack, a rogue employee, government pressure, a bug, improperly handled backups, or various other means. It can happen, has happened, and will happen again.
HTTPS is kind of mostly good enough for general use, since exploits are not so common as to make it useless, but if a government sees it as an obstacle, all bets are off. It is not comparable to a trustworthy VPN hosted outside of the government's reach.
Also, HTTPS doesn't cover all traffic like a properly configured VPN does. Even where it is used and not compromised, it's not difficult for a well positioned snooper (like an internet provider that has to answer to government) to follow your traffic on the net and deduce what you're doing.
Great thing, that you can remove them and only trust those you trust.
Pls explain what https is not covered? The SNI on tbe first visit? A VPN just moves the "exit point" of your traffic. Now the Datacentef and VPN provider sees what you ISP saw.
No. I never said otherwise. But they cannot spy on the traffic. And since the SNI is not encrypted anyway they do not even nerd to "follow the traffic". But what sites you are visiting and what you are doing on them are 2 different things.
Lol OK. Every US company has to legally provide their private keys (or a subordinate CA) to the US government if asked, due to NSL laws. We have examples of the US doing this historically, only because some companies broke the law and spoke out publicly.
So go ahead and remove all CAs issued from US companies. Verisign, cloudflare, akamai, Microsoft, Amazon, etc.
Now 80% of the Internet is broke.
And? If you cannot trust then you should not use them when you want to do something that is private and should not get looked on.
And if there were signs of misuse of the trust, then they would get removed.
It is actually really easy to monitor thanks to CT.
Yes, there is countless examples of root CAs containing compromised CAs. Also the private keys live on the server, hot. That's why we sign with release keys that are not stored on the publishing infr
Then pls proof that? Link to a recent article maybe?
https://www.theregister.com/2024/07/31/digicert_certificates_extension/
DigiCert isn't the only one. There's a bunch of others. Just google "Mozilla CA removed" or "google CA removed"
Here's a couple more examples, but this sort of thing happens all the time, because X.509 is just a terrible design that breaks https
https://bugzilla.mozilla.org/show_bug.cgi?id=1567114
https://www.eff.org/deeplinks/2019/02/cyber-mercenary-groups-shouldnt-be-trusted-your-browser-or-anywhere-else
This incidence with digicert is not about a compromised CA it is about a flaw in their validation system. That is not what you claimed. Such flaws happen from time to time, lets encrypt had an issue a while back too.