IETF Logo Mail Archive

Re: [TLS] Eleven out of every ten SSL certs aren't valid

Martin Rex <mrex@sap.com> Wed, 30 June 2010 16:40 UTC

Return-Path: <mrex@sap.com>
X-Original-To: tls@core3.amsl.com
Delivered-To: tls@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 092763A685A for <tls@core3.amsl.com>; Wed, 30 Jun 2010 09:40:59 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -9.109
X-Spam-Level:
X-Spam-Status: No, score=-9.109 tagged_above=-999 required=5 tests=[AWL=1.140, BAYES_00=-2.599, HELO_EQ_DE=0.35, RCVD_IN_DNSWL_HI=-8]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2HKInO0L5yyB for <tls@core3.amsl.com>; Wed, 30 Jun 2010 09:40:57 -0700 (PDT)
Received: from smtpde01.sap-ag.de (smtpde01.sap-ag.de [155.56.68.170]) by core3.amsl.com (Postfix) with ESMTP id 890343A690C for <tls@ietf.org>; Wed, 30 Jun 2010 09:40:57 -0700 (PDT)
Received: from mail.sap.corp by smtpde01.sap-ag.de (26) with ESMTP id o5UGf5te017970 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); Wed, 30 Jun 2010 18:41:06 +0200 (MEST)
From: Martin Rex <mrex@sap.com>
Message-Id: <201006301641.o5UGf5Xn013913@fs4113.wdf.sap.corp>
To: ivan.ristic@gmail.com
Date: Wed, 30 Jun 2010 18:41:05 +0200
In-Reply-To: <AANLkTilrxnI75aIH7fdePFhOrdcq8YD9N_clrfqaqdoa@mail.gmail.com> from "Ivan Ristic" at Jun 30, 10 08:50:14 am
MIME-Version: 1.0
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 8bit
X-Scanner: Virus Scanner virwal07
X-SAP: out
Cc: tls@ietf.org
Subject: Re: [TLS] Eleven out of every ten SSL certs aren't valid
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: mrex@sap.com
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 30 Jun 2010 16:40:59 -0000

Ivan Ristic wrote:
> 
> On Wed, Jun 30, 2010 at 8:35 AM, Bruno Harbulot
> <Bruno.Harbulot@manchester.ac.uk> wrote:
> > ...
> > (I'm still not fully convinced of the benefits of EV, though.)
> 
> There's an advantage or two:
> 
> - Phishing sites are unlikely to have them
> - They work as a defence against phishing & MITM attacks that use
>   homograph attacks or non-Lating domain names (e.g., paypal.com written
>   in Russian as raural.com, or something).

This sound like:

All server certs are equal, but some server certs are more equal than others.

While the basic idea comes down to "reduce the number of
your trust anchors" the current approach first of all
provides a stronger business model for CAs.

Recoloring a part of the browser toolbar is a feature developed
by marketeers.  Unless it is clearly defined how things should
work with protocols (rfc-2818 or draft-saintandre-tls-server-id-check)
this approach is going to create new problems, because it completely
ignores programmatic clients.


-Martin

v2.23.0 | Report a Bug | By Email