full-disclosure - HTTP AUTH BASIC monowall

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Thu Mar 16 23:59:38 2006
From: jasonc at science.org (Jason Coombs)
Subject: HTTP AUTH BASIC monowall

Brian Eaton wrote:
> I'd like to see their process
> changed so that it included a more
> serious check into the business
> whose web site they are verifying.

This makes no sense at all, and is simply impossible within the DNS system. Furthermore, all verification done by any CA can be easily fooled. Only fools trust any CA.

What's wrong with expecting the end-user to be able to think clearly enough to find out what the *actual* trustworthy public key *actually is* for communicating with the *authentic* entity that the end-user wishes to communicate?

Three changes are required:

1. Do away with CA's entirely. Immediately. No sunset period.

2. Every entity that possesses a key pair makes a minimal effort to communicate their authentic public key to the people with whom they expect to communicate.

3. Give end-users a simple way to fixate trust within their client software to just the *single* public key that they have reason to believe is associated with the entity with whom they intend to communicate, and revoke client software's existing open-ended CA-mediated trust model, putting an immediate stop to it entirely.

The only reason this is not done is that Verisign's multimillions in revenue around their CA-related business, and their future business plans involving 'security' in general, would cease to exist.

Reliable (and cost-free) security based on common sense would take its place, but nobody really wants security, do they? People just want things that are complicated so they can learn secret voodoo business trade secrets and grow new business ventures.

People who really want security already have it, so distrust anyone who claims to be able to sell it to you.

Regards,

Jason Coombs
jasonc@...ence.org