SSL and the Future of Authenticity

Transkript

1 SSL and the Future of Authenticity Moxie Marlinspike Whisper Systems Session ID: HT2-107 Session Classification: Intermediate

2 SSL And The Future Of Authenticity Moving beyond Certificate Authorities

3 Comodo

4 Web Firm Suspects Iran Hacked Into It Internet-Security Company Says It Was Tricked Into Authenticating Fake Sites, Opening Access to Data, Not Money Wall Street Journal, March 15th, 2011

5 The Damage mail.google.com login.yahoo.com login.skype.com addons.mozilla.org login.live.com

6 This [attack] was extremely sophisticated and critically executed...it was a very well orchestrated, very clinical attack, and the attacker knew exactly what they needed to do and -- Melih Abdulhayoglu, Comodo Founder how fast they had to operate.

7 All the IPs were from Iran Melih Abdulhayoglu, Comodo Founder

8 cyber

9 All of the above leads us to one conclusion only: -- Melih Abdulhayoglu, Comodo Founder that this was likely to be a state-driven attack.

10 picture

11 hack --> war

12 What does this mean?

13 How would they use them?

14 sslsniff

15

16 [16/Mar/2011:09:56: ] GET HTTP/ Mozilla/5.0 (Windows; U; Windows NT 5.1; en-us; rv: Gecko/ Firefox/ (.NET CLR ;.NET4.0E)

17 [16/Mar/2011:09:56: ] GET HTTP/ Mozilla/5.0 (Windows; U; Windows NT 5.1; en-us; rv: Gecko/ Firefox/ (.NET CLR ;.NET4.0E)

18 [16/Mar/2011:09:56: ] GET HTTP/ Mozilla/5.0 (Windows; U; Windows NT 5.1; en-us; rv: Gecko/ Firefox/ (.NET CLR ;.NET4.0E)

19 [16/Mar/2011:09:56: ] GET HTTP/ Mozilla/5.0 (Windows; U; Windows NT 5.1; en-us; rv: Gecko/ Firefox/ (.NET CLR ;.NET4.0E)

20 referrer

21

22 ...it was a very well orchestrated, very clinical attack, and the attacker knew exactly what they needed to do and how fast they -- Melih Abdulhayoglu had to operate. vs

23 And more embarrassing Google search referrers... SSL protocol mitm howto iptables prerouting

24

25 He just wouldn t shut up!

26 If there were a Secure and Trusted DNS this issue would be a moot point! We need a Secure and Trusted DNS! -- Melih Abdulhayoglu, Comodo Founder

27 Comodo admits two more resellers pwned in SSL cert hack How deep does the rabbit hole go? The Register, March 30th, 2011

28 New hack on Comodo reseller exposes private data And then there were four The Register, May 24th, 2011

29 What happened to Comodo?

30 nothing

31 Melih Abdulhayoglu named entrepreneur of the year at RSA 2011.

32 problem

33 A Secure Protocol Secrecy Integrity Authenticity

34 early 90 s

35 ! information

36 ! e-commerce

37 ! web applications

38 tiny

39 < 5 million

40 > 4 billion

41 < 10 secure sites

42 > 2 million

43 intense pressure

44 4am decisions == javascript

45 A Secure Protocol Secrecy Integrity Authenticity

46 A Secure Connection Client PayPal

47 A Secure Connection Attacker Client PayPal

48 entirely theoretical

49 certificates and certificate authorities

50 ...a bit of a hand wave.

51

52

53

54

55

56 cyber war

57 happening every day

58 login.live.com?

59 Mike Zussman just asked for it.

60 Eddy Nigg got mozilla.com...with no validation

61 VeriSign issued Microsoft Corporation

62 SSL-In-A-Box.com

63 These are the people securing the internet.

64

65

66

67 State Sponsored?

68

69 good news

70 total ripoff total ripoff and mostly worthless

71 problem?

72 Fritz-Haber-Institut der Max-Planck-Gesellschaft Campus Berlin-Buch Westsaechsische Hochschule Zwickau FIZ CHEMIE Berlin GmbH DFN-CERT Services GmbH Forschungsverbund Berlin e.v. Humboldt-Universitaet zu Berlin Universitaet Flensburg T-Systems SfR Deutsche Nationalbibliothek Hochschule Furtwangen Universitaet Erlangen-Nuernberg T-Systems SfR GmbH Hochschule Bremerhaven Fachhochschule Flensburg GeoForschungsZentrum Potsdam Jacobs University Bremen ggmbh Universitaet Erfurt IFW Dresden e.v. Universitaet Marburg Universitaet Augsburg Leibniz-Rechenzentrum Universitaet Muenster IFM-GEOMAR Fachhochschule Landshut Universitaet Leipzig Fachhochschule Ansbach HAWK Fachhochschule Hildesheim/Holzminden/Goettingen Hochschule Kempten Rheinische Fachhochschule Koeln ggmbh Uni-Konstanz Universitaet Stuttgart Fachhochschule Luebeck Fachhochschule Bielefeld Universitaet Potsdam Hochschule Anhalt (FH) Friedrich-Loeffler-Institut Hochschule Fulda Beuth Hochschule fuer Technik Berlin Universitaet Ulm Fachhochschule Rosenheim Fachhochschule Ingolstadt Technische Universitaet Berlin Universitaet Jena Hochschule Biberach IPK Gatersleben Max-Planck-Institut fuer Zuechtungsforschung Universitaet Mannheim NEC Europe Ltd. Bundesanstalt fuer Wasserbau Fachhochschule Stralsund Universitaet Dortmund Hochschule Bremen Deutsches Elektronen-Synchrotron DESY Stiftung Tieraerztliche Hochschule Hannover Technische Fachhochschule Georg Agricola zu Bochum Universitaet Bielefeld Fachhochschule Aachen Otto-Friedrich-Universitaet Bamberg Fachhochschule Osnabrueck Universitaet Bremen Paedagogische Hochschule Heidelberg Technische Universitaet Braunschweig Institut fuer Photonische Technologien e.v. Universitaet Bayreuth Universitaet Wuerzburg Universitaet zu Koeln Technische Universitaet Chemnitz Hochschule fuer Technik und Wirtschaft Berlin Hochschule fuer Technik Stuttgart Universitaet Passau Hochschule fuer Musik und Theater Hannover Helmholtz-Zentrum fuer Infektionsforschung GmbH Ruhr-Universitaet Bochum Mitteldeutscher Rundfunk Berlin-Brandenburgische Akademie der Wissenschaften Berufsakademie Sachsen Staatliche Studienakademie Bautzen Max-Planck-Gesellschaft Fachhochschule Giessen-Friedberg Staatliche Hochschule f. Musik u. Darstellende Kunst Stuttgart Johann Wolfgang Goethe-Universitaet Forschungszentrum Dresden-Rossendorf e.v. Max-Planck-Institut fuer Biophysik Universitaet zu Luebeck Hochschule fuer Musik und Theater Leipzig Technische Universitaet Darmstadt Technische Universitaet Hamburg-Harburg Universitaet Kiel Hochschule Darmstadt Heinrich-Heine-Universitaet Duesseldorf Medizinische Hochschule Hannover Universitaet Osnabrueck Hochschul-Informations-System GmbH Mathematisches Forschungsinstitut Oberwolfach ggmbh Leibniz-Institut fuer Polymerforschung Dresden e.v. Fachhochschule Augsburg Leuphana Universitaet Lueneburg Paedagogische Hochschule Schwaebisch Gmuend AC CAMERFIRMA S.A. Regionales Hochschulrechenzentrum Kaiserslautern Deutsches Klimarechenzentrum GmbH Universitaet der Bundeswehr Muenchen Fachhochschule Braunschweig/Wolfenbuettel Zentrum fuer Informationsverarbeitung und Informationstechnik Deutsches Zentrum fuer Luft- und Raumfahrt e.v. (DLR) Hochschule fuer Technik, Wirtschaft und Kultur Leipzig Deutsches Institut fuer Ernaehrungsforschung (DIfE) Max-Planck-Institut zur Erforschung von Gemeinschaftsguetern AC Camerfirma SA CIF A Helmholtz-Zentrum Berlin fuer Materialien und Energie GmbH Bayerische Staatsbibliothek ESO - European Organisation for Astronomical Research Swisscom AC Camerfirma SA state-institutions Hochschule Mittweida (FH) - University of Applied Sciences Konrad-Zuse-Zentrum fuer Informationstechnik Berlin (ZIB) Georg-August-Universitaet Goettingen Technische Universitaet Dresden Technische Fachhochschule Berlin Universitaet Hamburg Bibliotheksservice-Zentrum Baden-Wuerttemberg Hochschule Karlsruhe - Technik und Wirtschaft Ludwig-Maximilians-Universitaet Muenchen ComSign Ltd. Bank Leumi Le-Israel LTD AC Camerfirma S.A. Hochschule fuer Wirtschaft und Umwelt Nuertingen-Geislingen Fachhochschule Oldenburg/Ostfriesland/Wilhelmshaven Forschungszentrum Juelich GmbH Paedagogische Hochschule Ludwigsburg Akademie fuer Lehrerfortbildung und Personalfuehrung Dillingen ComSign Helmut-Schmidt-Universitaet Universitaet der Bundeswehr Hamburg Wissenschaftszentrum Berlin fuer Sozialforschung ggmbh Hochschule Bonn-Rhein-Sieg Universitaet Duisburg-Essen Leibniz-Zentrum fuer Agrarlandschaftsforschung (ZALF) e. V. Georg-Simon-Ohm-Hochschule f. angewandte Wissenschaften FH Nbg Technische Universitaet Ilmenau Universitaet Regensburg Bundesanstalt f. Geowissenschaften u. Rohstoffe C=TW, O=Government Root Certification Authority Microsoft Trust Network Fachhochschule Weihenstephan DFN-Verein Freie Universitaet Berlin Technische Universitaet Clausthal xe8xa1x8cxe6x94xbfxe9x99xa2 Hochschule Magdeburg Stendal (FH) Fachhochschule Frankfurt am Main Leibniz-Institut fuer Atmosphaerenphysik Helmholtz-Zentrum fuer Umweltforschung GmbH - UFZ Deutsches Institut fuer Wirtschaftsforschung e.v. (DIW Berlin) Technische Universitaet Dortmund Hochschule fuer angewandte Wissenschaften - FH Deggendorf C=hk, O=C&W HKT SecureNet CA Class B Wells Fargo WellsSecure Leibniz-Institut fuer Analytische Wissenschaften - ISAS - e.v. Hochschule fuer Grafik und Buchkunst Leipzig Hochschule fuer Wirtschaft und Recht Berlin Otto-von-Guericke-Universitaet Magdeburg Wells Fargo Deutsches Institut fuer Internationale Paedagogische Forschung Universitaet des Saarlandes Gesellschaft fuer Schwerionenforschung mbh (GSI) VISA Deutsches BiomasseForschungsZentrum gemeinnuetzige GmbH Deutscher Bundestag Martin-Luther-Universitaet Halle-Wittenberg A-Trust Ges. f. Sicherheitssysteme im elektr. Datenverkehr GmbH Serasa S.A. Hochschule fuer angewandte Wissenschaften Fachhochschule Hof Hahn-Meitner-Institut Berlin GmbH Fachhochschule Bonn-Rhein-Sieg Baltimore Fachhochschule fuer Technik und Wirtschaft Berlin FernUniversitaet in Hagen Universitaet Greifswald Bauhaus-Universitaet Weimar STIFTUNG PREUSSISCHER KULTURBESITZ Ministere education nationale (MENESR) Hochschule fuer angewandte Wissenschaften Fachhochschule Coburg Max-Planck-Institut fuer Gesellschaftsforschung Hochschule Ostwestfalen-Lippe Hochschule fuer Kuenste Bremen EUnet International Deutsche Telekom AG, Laboratories Hochschule Mannheim Bundesinstitut fuer Risikobewertung SHECA UniTrust PrvnxC3xAD certifikaxc4x8dnxc3xad autorita, a.s. Deutsches Krebsforschungszentrum (DKFZ) Freistaat Sachsen Leibniz-Institut fuer Plasmaforschung und Technologie e.v. Hochschule Ravensburg-Weingarten Leibniz-Institut fuer Neurobiologie Magdeburg Echoworx Corporation Fachhochschule Wuerzburg-Schweinfurt Technische Universitaet Bergakademie Freiberg Fachhochschule Erfurt Technische Universitaet Muenchen Halcom Agencia Catalana de Certificacio (NIF Q I) Hochschule fuer Angewandte Wissenschaften Hamburg Hochschule Wismar Hochschule Zittau/Goerlitz Universitaet Rostock AS Sertifitseerimiskeskus Kath. Universitaet Eichstaett-Ingolstadt Leibniz Universitaet Hannover Universitaet Giessen Fachhochschule Kiel DIRECCION GENERAL DE LA POLICIA Saunalahden Serveri Oy Fachhochschule Brandenburg Hochschule fuer Gestaltung Karlsruhe Duale Hochschule Baden-Wuerttemberg RWTH Aachen INDIA PKI Helmholtz Zentrum Muenchen Hochschule Heilbronn Fachhochschule Aschaffenburg IZENPE S.A. Consejo General de la Abogacia NIF:Q I Universitaet Kassel NORDAKADEMIE gag Fachhochschule Neu-Ulm Dhimyotis Ministere Education Nationale (MENESR) CBEC Bergische Universitaet Wuppertal Hochschule Esslingen EDICOM C=hk, O=C&W HKT SecureNet CA Class A Universitaet Siegen Universitaet Heidelberg Land Niedersachsen xc4x8ceskxc3xa1 poxc5xa1ta, s.p. [IxC4x8C ] India PKI Alfred-Wegener-Institut Hochschule Merseburg (FH) Mahanagar Telephone Nigam Limited Netrust Certificate Authority 1 Badische Landesbibliothek Technische Fachhochschule Wildau Belgacom VAS Latvijas Pasts - Vien.reg.Nr Mahanagar Telephone Nigam Limited National Informatics Centre TuTech Innovation GmbH Physikalisch-Technische Bundesanstalt Gouv Buypass AS Fachhochschule Regensburg Bundesamt fuer Kartographie und Geodaesie A-Trust ViaCode IZENPE S.A. - CIF A RMerc.Vitoria-Gasteiz T1055 F62 S8 Gesellschaft fuer wissenschaftliche Datenverarbeitung Hochschule Ulm service-public gouv agriculture Fachhochschule Dortmund Hochschule Offenburg Universitaet der Kuenste Berlin Port Autonome de Marseille Universitaet Bonn Fachhochschule Wiesbaden Hochschule Niederrhein admin C=hk, O=C&W HKT SecureNet CA Root PM/SGDN Ministere en charge des affaires sanitaires et sociales AOL Time Warner Inc. Hochschulbibliothekszentrum NRW Bundesamt fuer Strahlenschutz Fachhochschule Jena Secteur public xc3x89cologie DxC3xA9veloppement et AmxC3xA9nagement durables Hochschule Muenchen Fachhochschule Muenster Hochschule Aalen E-CERTCHILE MINEFI MinistxC3xA8re xc3x89cologie, DxC3xA9veloppement et AmxC3xA9nagement durables PTT Post Coventry City Council Karlsruhe Institute of Technology Universitaet Karlsruhe Charite - Universitaetsmedizin Berlin Trustis Limited Fachhochschule Hannover Deutsches Herzzentrum Berlin Universitaet Freiburg HafenCity Universitaet Hamburg First Data Digital Certificates Inc. TxC3xBCrkiye Bilimsel ve Teknolojik AraxC5x9FtxC4xB1rma Kurumu - TxC3x9CBxC4xB0TAK B.A.T. Universitaet Tuebingen GESIS Fachhochschule Suedwestfalen POSTA MessageLabs BESSY Fachhochschule Gelsenkirchen Hochschule Amberg-Weiden Deutscher Wetterdienst Paedagogische Hochschule Freiburg Autoridad Certificadora Raiz de la Secretaria de Economia, OU Ministere de la Justice Autoridad Certificadora de la Asociacion Nacional del Notariado Mexicano, A.C., O Japan Certification Services, Inc. Deutsche Telekom AG HS-Harz Fraunhofer Dioezese Rottenburg-Stuttgart Hochschule Neubrandenburg x00ax00-x00tx00rx00ux00sx00tx00 x00gx00ex00sx00.x00 x00fx00xfcx00rx00 x00sx00ix00cx00hx00ex00rx00hx00ex00ix00tx00sx00sx00yx00sx00tx00ex00mx00ex00 x00ix00mx00 x00ex00lx00ex00kx00tx00rx00.x00 x00dx00ax00tx00ex00nx00vx00ex00rx00kx00ex00hx00rx00 x00gx0 TeliaSonera T-Systems Enterprise Services GmbH Government CA/serialNumber esign Australia CEDICAM Deutsche Post World Net C=AT, ST=Austria, L=Vienna, O=Arge Daten Oesterreichische Gesellschaft fuer Datenschutz/ Address=a-cert@argedaten.at Belgium Root CA2 BAH FNMT-RCM Certplus KEYNECTIS E-Telbank Sp. z o.o. CERTINOMIS GlobalSign Generalitat Valenciana Belgium Root CA Department of Education and Training Government CA InfoNotary PLC TxC3x9CRKTRUST Bilgi xc4xb0letixc5x9fim ve BilixC5x9Fim GxC3xBCvenlixC4x9Fi Hizmetleri A.xC5x9E. (c) KasxC4xB1m 2005 C=SI, O=ACNLB Servicio de Certificacion del Colegio de Registradores (SCR)

73 AURA - Gemini Observatory GDT-EntSubCA-Public KIBS AD Skopje QuoVadis Trustlink Schweiz AG TxC3x9CRKTRUST Elektronik Sunucu SertifikasxC4xB1 Hizmetleri, C certsign Jabber Software Foundation Northern Arizona University Mobile Armor Enterprise CA QuoVadis Limited ACE Limited StartCom Ltd. Nestle Jo Tankers Coop Genossenschaft Autoridad de Certificacion Firmaprofesional CIF A Autoridad de Certificacion Firmaprofesional CIF A / Address E-ME SSI (RCA) Disig a.s. ABB Ltd. Alpha Miami University Migros ICC-CPI Firmaprofesional S.A. NIF A thawte, Inc. E-ME PSI (PCA) BGC-OffSubCA ADMINISTRACION NACIONAL DE CORREOS Audkenni hf. Ford Motor Company - Enterprise Issuing CA01 WISeKey DigiNotar B.V. I.CA - Qualified root certificate, O E-ME SI (CA1) An Post Giesecke and Devrient Comodo Japan Inc. Coop Touring Club Suisse (TCS) ESG BV C=au, O=SecureNet CA Class B Serasa Etisalat Digicert Sdn. Bhd. C=au, O=SecureNet CA Root ICP-Brasil XRamp Security Services Inc ZF LGPKI C=hk, O=C&W HKT SecureNet CA SGC Root agentschap Centraal Informatiepunt Beroepen Gezondheidszorg MSFT Thawte Consulting Thawte Consulting cc C=au, O=SecureNet CA Class A Bechtel Corporation Cybertrust Staat der Nederlanden Thawte Consulting (Pty) Ltd. IPS Certification Authority s.l. ipsca Macao Post Telekom-Control-Kommission I.T. Telecom InfoCert SpA GDT-SubCA-Public Sacred Heart University CA Certipost s.a./n.v. Postecom S.p.A. Betrusted Japan Co., Ltd. Munich Re Group Fundacion FESTE Getronics PinkRoccade Nederland B.V. Xcert EZ by DST QuoVadis Trustlink BV Digital Signature Trust U.S. Government CDC VeriSign, Inc. Sun Microsystems Inc VeriSign Japan K.K. AffirmTrust KAS BANK N.V. Kas Bank NV Unizeto Technologies S.A. Centro Nazionale per l Informatica nella PA MULTICERT-CA Siemens Issuing CA Class Internet Server V1.0 Betrusted US Inc VeriSign Trust Network Unizeto Sp. z o.o. American Express Channel Server CA 3 Comodo Limited GTE Corporation Trustwave Holdings, Inc. E-Sign S.A. Microsoft Root Certificate Authority SwissSign AG TAIWAN-CA.COM Inc. Syncrude Canada Ltd SecureTrust Corporation Ministerie van Defensie Microsoft Corporation C=au, O=SecureNet CA SGC Root YandexExternalCA Siemens Issuing CA Class STE Hongkong Post Chunghwa Telecom Co., Ltd. ABA.ECOM, INC. Actalis S.p.A. global FINMECCANICA Microsoft Internet Authority Elektronik Bilgi Guvenligi A.S. xe4xb8xadxe8x8fxafxe9x9bxbbxe4xbfxa1xe8x82xa1xe4xbbxbdxe6x9cx89xe9x99x90xe5x85xacxe5x8fxb8 ComSign Advanced Security CA LUPKI01 Cybertrust Japan Co., Ltd. Marks and Spencer Group plc Sempra Energy SignKorea TradeSign Equifax Secure TAIWAN-CA DigiCert Inc. GAD eg KISA yessign Autoridad Certificadora del Colegio Nacional de Correduria Publica Mexicana, A.C., O TxC3x9CRKTRUST Elektronik xc4xb0xc5x9flem Hizmetleri, C Dell Inc. Anthem Inc CrossCert ANCE Certisign Certificadora Digital Ltda. SAIC KICA Colegio de Registradores de la Propiedad y Mercantiles de EspaxC3xB1a Sociedad Cameral de CertificacixC3xB3n Digital - CerticxC3xA1mara S.A. Cybertrust Inc adidas AG Thawte I.CA - Standard root certificate, O SECOM Trust.net KBC Group D-Trust GmbH Agencia Notarial de Certificacion S.L. Unipersonal - CIF B IPS Internet publishing Services s.l. SIA S.p.A. SCEE IPS Seguridad CA SCEE - Sistema de CertificaxE7xE3o ElectrxF3nica do Estado Sonera Cisco Systems National Institute of Informatics Intesa Sanpaolo S.p.A. EBG BilixC5x9Fim Teknolojileri ve Hizmetleri A.xC5x9E. Entidad de Certificacion Digital Abierta Certicamara S.A. Digital Signature Trust Co. SECOM Trust Systems CO.,LTD. NalcoExternalPolicyCA-1 Secure Business Services, Inc. Vodafone Group Network Solutions L.L.C. Certicamara S.A. Entidad de Certificacion Deutscher Sparkassen Verlag GmbH Skaitmeninio sertifikavimo centras Japanese Government NetLock Kft. NetLock Halozatbiztonsagi Kft. FNMT Fuji Xerox Cybertrust, Inc DigiCert Inc Microsec Ltd. ValiCert, Inc. Trusted Secure Certificate Authority Microsoft Root Authority Vaestorekisterikeskus CA Actalis S.p.A./ Government of Korea Starfield Technologies, Inc. Servision Inc. Sempra Energy Secure Server CA1 Certeurope IDEACROSS INC. KAGOYA JAPAN Inc. GAD EG Wachovia Corporation RSA Security Inc. XiPS Microsoft Secure Server Authority RSA Data Security, Inc. America Online Inc. TaiOne International Ltd. Unicert Brasil Certificadora Positive Software Corporation MasterCard Worldwide INTEC Communications Inc. The Go Daddy Group, Inc. GLOBE HOSTING CERTIFICATION AUTHORITY SunGard Availability Services RegisterFly.com, inc. Earthlink Inc AusCERT NalcoExternalIssuingCA-1 The USERTRUST Network SHCRoot Saphety WebSpace-Forum, Thomas Wendt Entrust.net Registry Pro Network Associates WebSpace-Forum e.k. RSA Security Inc Accenture Digi-Sign Limited EUNETIC GmbH O=Mortgage and Settlement Service Trust CA shcica Equifax CENTRAL SECURITY PATROLS CO., LTD. TC TrustCenter GmbH SCEE - Sistema de CertificaxC3xA7xC3xA3o ElectrxC3xB3nica do Estado AddTrust Sweden AB Telstra Corporation Limited GoDaddy.com, Inc. Intesa Sanpaolo S.p.A. CA Servizi Esterni MindGenies COMODO CA Limited WoSign, Inc. Firstserver, Inc. DRS-TEM Wotone Communications, Inc. Register.com GANDI SAS ebiz Networks Ltd SGssl Comodo CA Limited Configuration, CN OVH SAS Intel Corporation UGIS S.p.A. TERENA Google Inc First Data Corporation TDC Internet Telstra RSS Issuing CA1 Aetna Inc. Entrust, Inc. AddTrust AB General Electric Company UIS-IntB-CA DigiNotar NTT DOCOMO, INC. GeoTrust Inc. CNNIC SSL FreeSSL GeoTrust, Inc. TDC RBC Hosting Center OptimumSSL CA UIS-IsuB1-CA The Walt Disney Company CA Jack Henry and Associates, Inc. Equifax Secure Inc. GeoTrust Inc TC TrustCenter for Security in Data Networks GmbH CNNIC ChainedSSL Nederlandse Orde van Advocaten The Walt Disney Company Commerce CA EON The Walt Disney Company Enterprise CA Energie-Control GmbH ARGE DATEN - Austrian Society for Data Protection ARGE DATEN - Austrian Society for Data Protection and Privacy e-commerce monitoring GmbH

74 650

75

76 VeriSign?

77 20 --> 2,000,000

78

79 DHS China

80 DHS China

81

82 What happened to Comodo?

83 nothing

84 What could we have done?

85 ! trust

86 trustdb -= comodo

87

88

89 ideological

90 browser vendors

91

92 forever

93 trust agility

94 Trust Agility Properties A trust decision can be easily revised at any time. Individual users can decide where to anchor their trust.

95 Trust Agility Properties A trust decision can be easily revised at any time. Individual users can decide where to anchor their trust.

96

97

98 Trust Agility Properties A trust decision can be easily revised at any time. Individual users can decide where to anchor their trust.

99 VeriSign Comodo

100 VeriSign Comodo Facebook

101 VeriSign Comodo Facebook

102 https?

103

104 one decision for everyone?

105 our data, our trust decision

106 Trust Agility Properties A trust decision can be easily revised at any time. Individual users can decide where to anchor their trust.

107 PayPal Authority User

108 PayPal Authority User

109 PayPal Authority User

110 PayPal Authority User

111 PayPal Authority User

112 PayPal Authority Authority User

113 Baidu DHS China User

114 Baidu DHS NGO User

115 Trust Agility Properties A trust decision can be easily revised at any time. Individual users can decide where to anchor their trust.

116 DNSSEC

117 SSL Cert --> DNS Record

118 Client Lookup paypal.com DNS Server

119 Client Lookup paypal.com DNS Server && SSL Certificate

120 distributed

121 information --> distributed

122 trust --> centralized

123 DNSSEC == CA System

124 Trust Requirements The Registrars. The TLDs. The root.

125 Trust Requirements The Registrars. The TLDs. The root.

126 sketchy++

127 GoDaddy

128 Trust Requirements The Registrars. The TLDs. The root.

129 .com,.net

130 VeriSign

131 .org,.edu

132 cctlds

133 .io,.cc,.ly?

134 .ir,.cn?

135

136

137 domain seizures

138 Trust Requirements The Registrars. The TLDs. The root.

139 ICANN

140 Global --> California 501(c)(3)

141 COICA, PROTECT IP, etc...

142 Trust Requirements The Registrars. The TLDs. The root.

143 < trust agility

144 trustdb -= VeriSign

145 Trust Requirements The Registrars. The TLDs. The root.

146 forever

147

148 Perspectives Dan Wendlandt, David G. Andersen, Adrian Perrig Carnegie Mellon University

149

150 perspective

151 Basic Premise Client PayPal

152 Basic Premise Client PayPal

153 Basic Premise Authority Client PayPal

154 Basic Premise Authority Client PayPal

155 Basic Premise Notaries Client PayPal

156 Basic Premise N N N N N Client PayPal

157 Basic Premise N N Client N PayPal N N

158 Basic Premise N N Client N PayPal N N

159 N Basic Premise N N N N N

160 perspective is not new

161 The CA Version Of Perspective VeriSign PayPal Site Admin

162 The CA Version Of Perspective VeriSign PayPal Site Admin

163 The CA Version Of Perspective VeriSign PayPal Site Admin

164 invert

165 user initiated

166 implementation

167 limited

168 self-signed certs

169 Perspectives Challenges Completeness Privacy Responsiveness

170 Perspectives Challenges Completeness Privacy Responsiveness

171 initial connection

172 ! eliminate CAs entirely

173 Perspectives Challenges Completeness Privacy Responsiveness

174 Privacy Problems Notary Client PayPal

175 Perspectives Challenges Completeness Privacy Responsiveness

176 notary lag

177 Notary Lag Notary Client PayPal

178 Notary Lag Notary Client PayPal

179 Notary Lag Notary Client PayPal

180

181 New Protocol New Client Implementation New Server Implementation

182 Perspectives Challenges Completeness Privacy Responsiveness

183 ! notary lag

184 Responsive: Eliminate Notary Lag Notary Client PayPal

185 + privacy

186 1) local caching

187 Local Caching Notary Client PayPal

188 Local Caching Notary Client PayPal Local Cache

189 Local Caching Notary Client PayPal Local Cache

190 Notary Bounce N N N N N Client

191 Notary Bounce N N N N Client N Bounce

192 Notary Bounce N N N N Client N Bounce

193 Notary Bounce N N N N Client N Bounce

194 Convergence : Firefox +

195

196

197

198

199

200

201

202 Convergence: Extensible for the future. Notary

203 Convergence: Extensible for the future. Notary Client REST PayPal

204 Convergence: Extensible for the future. Notary Client REST PayPal

205 Convergence: Extensible for the future. Notary DNSSEC Client REST PayPal

206 Convergence: Extensible for the future. Notary CA Signatures Client REST PayPal

207 Convergence: Extensible for the future. Notary SSL Observatory Client REST PayPal

208 Convergence: Extensible for the future. Notary Google Catalog Client REST PayPal

209 Multiplicity and Agility DNSSEC CA Signatures SSL Observatory Perspective N N N N Client N Bounce

210 Collective Trust DNSSEC CA Signatures SSL Observatory Perspective N N N N Consensus Client N Bounce Minority

211 Collective Trust DNSSEC CA Signatures SSL Observatory Perspective N N N N Consensus Client N Bounce Minority

212 Collective Trust DNSSEC CA Signatures SSL Observatory Perspective N N N N Consensus Client N Bounce Minority

213 Collective Trust DNSSEC CA Signatures SSL Observatory Perspective N N N N Consensus Client N Bounce Minority

214 Collective Trust Perspective DNSSEC N N N SSL Observatory Client Consensus N Bounce Minority

215 Collective Trust DNSSEC CA Signatures SSL Observatory Perspective N N N` N Consensus Client N Bounce Minority

216 Other Nice Things Servers Do Nothing

217 Other Nice Things!migrate internet

218 Other Nice Things (1) Implement Convergence in the four major browsers. (2) Be done.

219 Other Nice Things no more self-signed certificate warnings

220 problems

221 citibank problem

222

223 captive portals

224

225 Leave with this: Who do I have to trust?...and for how long?

226 A prescribed set of people, forever.