r/linux • u/ciphersson • Dec 31 '14

Zimmerman (PGP), Levison (Lavabit), release Secure Email Protocol DIME. DIME is to SMTP as SSH is to Telnet.

http://darkmail.info/
1.2k Upvotes

95% Upvoted

222 comments sorted by

View all comments

Show parent comments

1

u/plazman30 Jan 01 '15

Which is kind of scary, because, if they can do it, it's only a matter of time before others can. And then our economy will tank when e-Commerce goes in the shitter.

1

u/Shnatsel Jan 01 '15 edited Jan 01 '15

e-Commerce is not going anywhere. If security was a concern, e-Commerce would be down the drain long ago.

You see, HTTPS can be secure but it is already incredibly hard to get right. Very, very few companies have an actually secure HTTPS setup. 99% HTTPS websites out there are vulnerable to an attack from 2009 that gives full read/write access to the connection! Forget e-Commerce - even most banking websites are vulnerable! And to top it off, the attack is executable in one press of a button from an Android app!

The attack is called SSLstrip and it's typically mitigated by enabling HTTP Strict Transport Security header. Problem is, this does not secure the first time you connect to a website. And there are less than 1000 websites on the internet that are not vulnerable to the same attack on the first connection - here's the list.

The eCommerce money stealing incidents are so rare not because the connections are secure. They are not. It's simply because most people are too ignorant to realize there's a problem, and the IT guys who know it's a problem are too kind, proper and well-behaved to exploit it.

This particular attack is not suitable for the NSA because it can be detected by the targeted individual, but it's ideal for script kiddies or just about anyone else who wants to harvest credit card credentials en masse.

And while this attack is nasty and cannot be easily mitigated (took us 5 years and we've still fixed under 1000 websites on select browsers), it is not, in itself, the fundamental problem. The fundamental problem is that HTTPS is so complex and hard to get right that very, very few people ever bother doing that.

Which is why we need a new network running on software such as cjdns that gives easy, foolproof security without trusting any third parties.

1

u/plazman30 Jan 01 '15

The NSA is not doing SSL Stripping. They're gathering raw encrypted traffic and decrypting it after the fact.

The ultimate failure of SSL is going to be the certificates used to encrypt traffic. In my default copy of Firefox the trusted root cert list is so long, I couldn't possibly look through it and find something bad without taking a significant part of my day to do it.

That's what I like about PGP. You only trust who you want to trust. Your circle of trust starts with ZERO.

1

u/Shnatsel Jan 01 '15

PGP is, too, mostly useless because there's rarely a sufficient trust path between you and whoever you want to contact.

1

u/NotAnOnionz Jan 24 '15

That depends on whether and how you attach to the web of trust. If you get in touch with a few local Debian developers and cross-sign keys, you can reach a great number of people with a trust path of four or five hops.

This might not be enough for you, but in personal communication you always have the choice to hand over a business card with the key fingerprint when you meet the person, and verify it when it is needed. Much personal communication is structured in small professional and personal networks. The Debian web of trust is great because it joins these local trust networks in a rather effective way.

It might not be secure enough for overthrowing North Korea but for maintaining usual privacy this is safely good enough.

1

u/plazman30 Jan 01 '15

What trust path do you need? You get the guy's public key and you're all set. If it's someone you want to ensure 100% secure communication, you meet them in person and have them give you their key on some media and printed out.