Re: [TLS] [POSSIBLE SPAM] Re: Asking the browser for a different certificate

["Kemp, David P." <[e-mail]>]

Neither AT&T nor China can authenticate themselves as facebook.com
(assuming the browser trust list is properly managed, all trusted
issuers are trustworthy, the user won't confuse facebook.com.cn with
facebook.com, etc.).  ADH does not protect against data stealing or
session hijacking in general; authenticated TLS performs that function.
The ADH tunnel protects just one small piece of data (the certificates)
from eavesdropping during the TLS authentication handshake.

If AT&T and China and 10 other players all insert themselves between the
user and facebook.com, they can all learn the identities of the user and
of facebook.  But none of them can view or modify any data sent over
mutually-authenticated TLS.

Social networking sites are not a useful example because they don't use
TLS for most pages and they don't do client authentication for the few
pages that do use TLS.  But if banking / medical sites actually used
client-authenticated TLS for all pages (instead of little
phish-prevention pictures and personal-knowledge questions and
passwords), then AT&T would be out of luck.

Dave


-----Original Message-----
From: Marsh Ray [mailto:[e-mail]] 
Sent: Tuesday, March 30, 2010 10:51 AM
To: Kemp, David P.
Cc: TLS Mailing List
Subject: Re: [TLS] [POSSIBLE SPAM] Re: Asking the browser for a
different certificate
Importance: Low

On 3/30/2010 9:24 AM, Kemp, David P. wrote:
> ADH is a pretty standard way of
> reducing ID exposure from an infinite number of attackers down to 1
> active party

It doesn't reduce it to one active party because Malloy can't know any
better than Alice or Bob if one of his connections is itself being
MITM'd.

One could imagine amusing scenarios where AT&T and China bump into each
other on the wire and begin to argue "hey, buddy, go get your own
Facebook connection".

http://mashable.com/2010/01/16/att-facebook-error/
https://lists.dns-oarc.net/pipermail/dns-operations/2010-March/005260.ht
ml

> and 0 passive parties.  That's a fairly significant
> reduction.

Defeating passive eavesdropping is important, but it's sufficient in
general.

In the past, people were on shared Ethernet and would naturally be in a
position to quietly observe every packet going by.

For several common types of attacks today it's no harder to modify the
packets than it is to observe them. Think of China and Pakistan DNS- and
BGP-jacking YouTube for recent examples.

- Marsh