Re: [TLS] TLS, PKI,

[Martin Rex <[e-mail]>]

Robert Relyea wrote:
> 
> >
> > If SSHv1 would have required CA-signed X.509 certs in its initial
> > shipment, it would have taken MUCH longer to become popular, if at all.
> 
> Compared to SSL, SSH is still not popular, which sort of negates your
> point.

Quite the opposite.  Compared to SSH, SSL is a complete and utter failure.

SSH became popular in 1995 and ubiquitous on Unix platforms before 2000.

Probably >>95% of all admins of networked Unix boxes have SSH configured
and used it to access their machines remotely.  Many of them have been
doing this for >10 years.

Even lots of networked devices support SSH out-of-the-box (DSL-router,
DVB-S receiver, Home-NAS) and SSH is quite easy to configure for use
with these devices.


In comparison, the number of Web-Servers that are accessible via
SSL/TLS (HTTPS) is completely negligible.  From that fraction of
the Web-Servers that have some service running on port 443
it is around 97% that do not support SSL/TLS access.


Considering the intimidating Scare-pages of newer Web-Browsers
for Servers using self-signed certs,  the Browser-Vendors reliably
killed the usage-scenario to use TLS to access your Home-NAS,
DSL-Router or DVB-S receiver, because going through the pain
to obtain and yearly renew TLS certs for each and every device
-- in particular for the shortcut hostnames that people are
typically using at home, which most Browser-blessed CAs are
unlikely to issue certs for anyway.


The most recent developments in TLS are likely to cut back the
use of TLS to only public commercial services.  The Scare-Pages
of recent Browsers are sure killers for any intra-Home-applicability
of TLS and the standardization efforts around "server identification"
(certid) are likely to make things worse, because they are
similarly preoccupied with commercial CA certs and bureaucratic
hierarchical namespace management.

Being able to easily network a small number of computers and
network-attached devices at home without involvement of outside
third parties is a pretty common use case.  It is where SSH
started and excels in.  It is where TLS hardly worked from
the beginning and where it has become much worse since due
to the Scare-Consumers-Away-From-This-Technology pages in
recent Browsers.


-Martin