Re: [pkix] fyi: Sovereign Keys: an EFF proposal for more secure TLS authentication

[Adam Langley <[e-mail]>]

On Mon, Dec 12, 2011 at 8:21 AM, Miller, Timothy J. <[e-mail]> wrote:
> That's not quite what I was asking.  How does the browser know that the
> list of notaries provided with the proof are the "correct" notaries for
> the site?

There isn't a different set of notaries for each site. The browser
knows and trusts a set of notaries. An attacker can choose the
notaries that it gets to sign a certificate and, if it gets a quorum
of notaries, then it has broken the system.

> Now we arrive at the kernel of your concept.  You¹ve improved detection,
> but only detection after the fact.  I posit that the average user wants
> detection before the fact.

Yes, I agree. But we're not proposing such a scheme because we don't
want to do better, but because we don't realistically think that we
can achieve anything stronger.

We're claiming that this is a real improvement on the status quo. A
counter argument may be to suggest that limited resources would be
better spent elsewhere. That means showing that CT is better than all
the alternatives, which we believe that it is. You have a specific
example of a possible, better path below...

> Further, in re: usability: I'm sorry, but at least some research on this
> specific topic (and admittedly there isn't much) directly contradicts you.
>  E.g., I refer you to:
>
> Simson Garfinkle. "Johnny 2: A User Test of Key Continuity Management with
> S/MIME and Outlook Express". Talk or presentation,  9, September, 2005.

I'm always happy to see actual UI research :) But it's very unclear if
KCM/TOFU translates to the web.

Everything's fine until a key changes, and keys certainly change in
the real world. In personal interactions, there are always
possibilities to query to key change. Indeed, folks in the study tried
a form of this, even though they couldn't phone/talk due to the
constraints of the study: "Some settled on a form of Email Based
Identification and Authentication[2]: they sent an email message to the
attacker’s apparent campaign address to see if the attacker could read
and reply to such messages."

But KCM on the web means that we end up asking users the question:
"The key for www.bankofamerica.com has changed. Trust yes/no?". We
have numbers from opt-in Chrome users which suggests that people click
through our big, red interstitials at a very high rate. But let's
assume that they phone Bank of America and manage to get confirmation
of a fingerprint. (That would be a pretty stunning achievement in
itself!)

But websites are complex, what happens when a subresource fails and we
ask the user: "The key for tc50.akacdn.com has changed..."?


Cheers

AGL


Cheers

AGL