QuicksilverJohn

Joined 16 years ago

Karma

Submissions

Member since

Apr 21

View on Hacker News

Recent submissions

Comment · 7 years ago

Yep. And it's also a DNS registrar.

Comment · 7 years ago

It's actually pretty difficult to enumerate all trusted CAs (or even just what organizations are running CAs). Certificate Transparency certainly helps there, but it's not fully required, and doesn't solve all problems.

The DigiNotar attack (from 2011) was mainly chosen because it's well known and easy to convey. It wasn't even that technically effectively because Chrome had Google's keys pinned, so it was immediately blocked and reported (like you would get with CT today). But, only in Chrome.

More recent examples of mississuance, like tricking Comodo's OCR-based validation [0] or spoofing DNS to hijack Let's Encrypt issuance [1].

CA's are always going to be vulnerable to these sorts of attacks, and they have such a broad attack surface and so much systemic trust (i.e power) that can cause unbounded damages with any error.

[0] https://bugzilla.mozilla.org/show_bug.cgi?id=1311713 [1] https://www.wired.com/2017/04/hackers-hijacked-banks-entire-...

Comment · 7 years ago

Basically, only the root record parsing is done in JS and then passed to unbound for resolution. Though it is possible to run a pure JS resolver, it's not really recommended.

There's also a more portable authoritative & recursive [resolver in C](https://github.com/handshake-org/hnsd).

Plus, the whole protocol for node communication and name resolution & proofs is so simple, that it's pretty easy to reimplement in any language.

Comment · 7 years ago

The problem with this method is that it requires a side channel. This is the real beauty of public key cryptography, you can negotiate a secure channel over an open channel. (*Authentication sold separately)

Comment · 8 years ago

No, Hangouts works great for this outside of the US. I use it in New Zealand all the time.