Gemini version available ♊︎

Transport Layer Security (TLS) is Fine, Centralised Certificate Authorities (CAs) Are Not

Posted in Deception, Security at 3:19 pm by Dr. Roy Schestowitz

Video download link | md5sum b147528fd1ea28881ed4578632fbd8b7
War on Decentralised Internet and Computing
Creative Commons Attribution-No Derivative Works 4.0

Summary: There’s a lot of misconception/misunderstandings about what the Certificate Authorities (CAs) are, what they’re for, how they work, and why they don’t actually tackle the biggest security and privacy problems, they’re mostly about centralisation of control and outsourcing of “trust” from pertinent sites/services to monopolies, empires, and oligarchs

SOME days ago someone was “[s]houting out to @tuxmachines to check your server. SSL certificate-based error messages are flying…”

This was not unforeseen. A lot of people sadly believe what Web browsers tell them, not bothering to take into account the agenda promoted by such Web browsers. It’s about control and centralisation, it’s not about security and/or privacy. A “malicious Web site can easily get a TLS certificate from a CA and turn the padlock on your browser green and go ahead and load,” DaemonFC reminds us. “And it’s still a malicious Web site.”

“Let’s Encrypt even admits that they do nothing to protect you from a malicious Web site, and suggest reporting those to Google and Microsoft,” DaemonFC adds.

“A lot has happened since then, notably Russia’s invasion of Ukraine, which resulted in a lot of censorship inside Russia, by Russia, and against Russia.”Those who say that getting a ‘good’ certificate is ‘free’ may be missing the point. It is like buying a ‘secure’ boot certificate from Microsoft on the ‘cheap’ (until the OEMs toss them out). We wrote about this in relation to Certificate Authorities before, with focus on the “big fish”, Let’s Encrypt [1, 2, 3], or LE.

The video above revisits this subject. A lot has happened since then, notably Russia’s invasion of Ukraine, which resulted in a lot of censorship inside Russia, by Russia, and against Russia. Now that the centralised systems are in place, censorship is vastly stronger. Is this security???

A given Gemini address is accessible so long as there’s a certificate in place, even a self-signed one (vouching for oneself). The same model ought to have been adopted for the Web. For online banking it would help if banks sent expected fingerprints, e.g. by post. Outsourcing to monopolies isn’t the way to go.

“Outsourcing to monopolies isn’t the way to go.”Readers might correctly spot the resemblance or notice the similarity to UEFI ‘secure’ boot. First they start with recommendations, saying it is all about security and enhancing safety. And then intimidation, seeking compliance from people who disregard the recommendations. Finally, they resort to outright locking out (blocking) anything that is not submissive, e.g. after 90% or more have already surrendered. So this is a form of blackmail for lock-down, initially marketed as a well-meaning security scheme. They’re insincere about motives. Nothing here is “free”…

Right now, after we’ve witnessed expansion in Web censorship, we believe stronger resistance will be needed by explaining to people what’s happening. Remember that this is not about security; it’s all about control and one day revoking certificates can be weaponised further and further, just like DNS-level censorship, denial of ClownFlare access, and so on. They typically start with “pirates”, “terrorism”, and “the children” before resorting to political angles. CAs can very easily and immediately be leveraged for outright censorship.

“Finally, they resort to outright locking out (blocking) anything that is not submissive, e.g. after 90% or more have already surrendered.”In the video above I remind people that the Linux Foundation‘s LE has already revoked millions of cerificates before (without even properly explaining what had happened!) and it’ll happen again sooner or later. Maybe at some point they’ll just decide to revoke all LE certificates for Russian sites, citing some political “sanctions”. Then what? Who’s next?

As an associate noted yesterday, “those that control the signing authorities can issue revocations at any time they feel like it and for any reason they feel like…”

In the case of Debian, we recently saw how trademarks get leveraged to censor criticism and hide problems. They just confiscate critics’ Web sites. Maybe we’ll do a video about this soon, seeing that the debian.community site is now succeeded by debian.day and debian.news. It’s a namespace battle in DNS.

DaemonFC concludes: “The only thing that HTTPS does do is help keep what you do to interact with the server private from outsiders, and that is important. But if you fall for a site claiming to be your bank because it has a green padlock, that doesn’t help you avoid a scam. One of the reasons I used to promote HTTPS Everywhere to everyone was because I believed the user should have the option to try to force it on with as many sites as possible. But I never would have argued for a system where HTTP is basically deprecated without TLS and browsers try to say there’s something wrong with accessing such a Web site if you don’t mind your information between your browser and that site remaining private. It’s a good “upgrade”. It is. It stops things like the Man-In-The-Middle Attacks that Comcast was using in order to spam its customers and inject advertisements into Web pages. So that’s why I started using it. I thought it was outrageous that wherever I went, here’s Comcast injecting alerts about data usage or ads for their TV package into my Google searches. HTTPS breaking that is a happy side-effect of what it does.”

“I was big on the idea of bringing CACert into the certificates package used by Mozilla, but they always found some bullshit reason not to. Like, they didn’t even want to talk about it. The whole situation with certificates is a legacy of Netscape. All of the old “players” that are really valuable and “trusted” by just about everything started out that way because Netscape Corporation put them in the Netscape Navigator browser. Then Microsoft came along with their stolen Internet Explorer product (they stiffed Spyglass Mosaic and then didn’t pay them) and lobbed all the same certificates in so that sites working in Netscape Navigator would also load in Internet Explorer. And then the tragedy just kept expanding from there. Opera had to throw all the same certificates in because they’ve never had more than 2% of the browser market. The user has really no control over how this works. It’s always been 100% Big Business. From Netscape to Microsoft to Apple and Google.”

“Remember when they had that Diginotar CA that was compromised? An entire CA! They had to revoke and remove an entire CA. What a mess that was. Everything in that “chain of trust” was broken and all the sites that used it had to get new certificates, and many Windows and Mac developers got caught with their pants down and had security alerts warning the users not to install the software that the OS was saying “THIS IS FINE!” about yesterday. That was hilarious, and sad. Sad because everyone watched what ensued and nothing was fixed. They revoked one CA and caused all sorts of Hell, but it could happen with any of them.”

They still push this very same agenda for software, not only Web sites, various services (including IRC), and booting.

MinceR then said that “PKI as a whole is badly designed.”

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

Decor ᶃ Gemini Space

Below is a Web proxy. We recommend getting a Gemini client/browser.

Black/white/grey bullet button This post is also available in Gemini over at this address (requires a Gemini client/browser to open).

Decor ✐ Cross-references

Black/white/grey bullet button Pages that cross-reference this one, if any exist, are listed below or will be listed below over time.

Decor ▢ Respond and Discuss

Black/white/grey bullet button If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

DecorWhat Else is New

  1. All of Microsoft's Strategic Areas Have Layoffs This Year

    Microsoft’s supposedly strategic/future areas — gaming (trying to debt-load or offload debt to other companies), so-called ‘security’, “clown computing” (Azure), and “Hey Hi” (chaffbots etc.) — have all had layoffs this year; it’s clear that the company is having a serious existential crisis in spite of Trump’s and Biden’s bailouts (a wave of layoffs every month this year) and is just bluffing/stuffing the media with chaffbots cruft (puff pieces/misinformation) to keep shareholders distracted, asking them for patience and faking demand for the chaffbots (whilst laying off Bing staff, too)

  2. Links 28/03/2023: Pitivi 2023.03 is Out, Yet More Microsoft Layoffs (Now in Israel)

    Links for the day

  3. IRC Proceedings: Monday, March 27, 2023

    IRC logs for Monday, March 27, 2023

  4. Links 27/03/2023: GnuCash 5.0 and Ubuntu 20.04 LTS on Phones

    Links for the day

  5. Links 27/03/2023: Twitter Source Code Published (But Not Intentionally)

    Links for the day

  6. IRC Proceedings: Sunday, March 26, 2023

    IRC logs for Sunday, March 26, 2023

  7. Links 26/03/2023: OpenMandriva ROME 23.03, Texinfo 7.0.3, and KBibTeX 0.10.0

    Links for the day

  8. The World Wide Web is a Cesspit of Misinformation. Let's Do Something About It.

    It would be nice to make the Web a safer space for information and accuracy (actual facts) rather than a “Safe Space” for oversensitive companies and powerful people who cannot tolerate criticism; The Web needs to become more like today's Gemini, free of corporate influence and all other forms of covert nuisance

  9. Ryan Farmer: I’m Back After WordPress.com Deleted My Blog Over the Weekend

    Reprinted with permission from Ryan

  10. Civil Liberties Threatened Online and Offline

    A “society of sheeple” (a term used by Richard Stallman last week in his speech) is being “herded” online and offline; the video covers examples both online and offline, the latter being absence of ATMs or lack of properly-functioning ATMs (a growing problem lately, at least where I live)

  11. Techrights Develops Free Software to Separate the Wheat From the Chaff

    In order to separate the wheat from the chaff we’ve been working on simple, modular tools that process news and help curate the Web, basically removing the noise to squeeze out the signal

  12. Links 26/03/2023: MidnightBSD 3.0 and FreeBSD 13.2 RC4

    Links for the day

  13. IRC Proceedings: Saturday, March 25, 2023

    IRC logs for Saturday, March 25, 2023

  14. Links 26/03/2023: More TikTok Bans

    Links for the day

  15. Links 25/03/2023: Gordon Moore (of Moore's Law) is Dead

    Links for the day

  16. Links 25/03/2023: Decade of Docker, Azure Broken Again

    Links for the day

  17. [Meme] Money Deducted in Payslips, But Nothing in Pensions

    Sirius ‘Open Source’ has stolen money from staff (in secret)

  18. IRC Proceedings: Friday, March 24, 2023

    IRC Proceedings: Friday, March 24, 2023

  19. The Corporate Media is Not Reporting Large-Scale Microsoft Layoffs (Too Busy With Chaffbot Puff Pieces), Leaks Required to Prove That More Layoffs Are Happening

    Just as we noted days ago, there are yet more Microsoft layoffs, but the mainstream media gets bribed to go “gaga” over vapourware and chaffbots (making chaff like “Bill Gates Says” pieces) instead of reporting actual news about Microsoft

  20. Sirius 'Open Source' Pensiongate: Time to Issue a Warrant of Arrest and Extradite the Fake 'Founder' of Sirius

    Sirius ‘Open Source’ is collapsing, but that does not mean that it can dodge accountability for crimes (e.g. money that it silently stole from its staff since at least 12 years ago)

  21. Links 24/03/2023: Microsoft's Fall on the Web and Many New Videos

    Links for the day

  22. IRC Proceedings: Thursday, March 23, 2023

    IRC logs for Thursday, March 23, 2023

  23. Links 24/03/2023: Social Control Media Bans Advancing

    Links for the day

  24. Links 24/03/2023: GNU Grep 3.10 and Microsoft Accenture in a Freefall

    Links for the day

  25. Links 23/03/2023: RSS Guard 4.3.3 and OpenBSD Webzine

    Links for the day

  26. Experiencing 15 Years of LibrePlanet Celebration Firsthand as a Volunteer: 2023 - Charting the Course

    Article by Marcia K Wilbur

  27. [Meme] Grabinski the Opportunity

    Reports of European Patents being invalidated (judges do not tolerate fake patents) have become so common that a kangaroo court becomes a matter of urgency for the EPO‘s Benoît Battistelli and António Campinos; will the EU and the EPO’s Administrative Council go along with it, helping to cover up more than a decade of profound corruption?

  28. Union Syndicale Fédérale Cautions the EPO's Administrative Council About Initiating an Illegal Kangaroo Court System for Patents (UPC) While EPO Breaks Laws and Sponsors the Ukraine Invasion

    Union Syndicale Fédérale (USF) is once again speaking out in support of the staff union of Europe's second-largest institution, which lacks oversight and governance because of profound corruption and regulatory capture

  29. Investigation Underway: Sirius 'Open Source' Embezzled/Stole Money, Robbed Its Own Staff

    In light of new developments and some progress in an investigation of Sirius ‘Open Source’ (for fraud!) we take stock of where things stand

  30. [Meme] Sirius 'Open Source' Pensions: Schemes or Scams? Giving a Bad Name to Open Source...

    What Sirius ‘Open Source’ did to its staff is rightly treated as a criminal matter; we know who the perpetrators are

RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts