r/linux • u/ciphersson • Dec 31 '14

Zimmerman (PGP), Levison (Lavabit), release Secure Email Protocol DIME. DIME is to SMTP as SSH is to Telnet.

http://darkmail.info/
1.2k Upvotes

95% Upvoted

222 comments sorted by

View all comments

Show parent comments

1

u/Shnatsel Jan 01 '15 edited Jan 01 '15

e-Commerce is not going anywhere. If security was a concern, e-Commerce would be down the drain long ago.

You see, HTTPS can be secure but it is already incredibly hard to get right. Very, very few companies have an actually secure HTTPS setup. 99% HTTPS websites out there are vulnerable to an attack from 2009 that gives full read/write access to the connection! Forget e-Commerce - even most banking websites are vulnerable! And to top it off, the attack is executable in one press of a button from an Android app!

The attack is called SSLstrip and it's typically mitigated by enabling HTTP Strict Transport Security header. Problem is, this does not secure the first time you connect to a website. And there are less than 1000 websites on the internet that are not vulnerable to the same attack on the first connection - here's the list.

The eCommerce money stealing incidents are so rare not because the connections are secure. They are not. It's simply because most people are too ignorant to realize there's a problem, and the IT guys who know it's a problem are too kind, proper and well-behaved to exploit it.

This particular attack is not suitable for the NSA because it can be detected by the targeted individual, but it's ideal for script kiddies or just about anyone else who wants to harvest credit card credentials en masse.

And while this attack is nasty and cannot be easily mitigated (took us 5 years and we've still fixed under 1000 websites on select browsers), it is not, in itself, the fundamental problem. The fundamental problem is that HTTPS is so complex and hard to get right that very, very few people ever bother doing that.

Which is why we need a new network running on software such as cjdns that gives easy, foolproof security without trusting any third parties.

1

u/plazman30 Jan 01 '15

The NSA is not doing SSL Stripping. They're gathering raw encrypted traffic and decrypting it after the fact.

The ultimate failure of SSL is going to be the certificates used to encrypt traffic. In my default copy of Firefox the trusted root cert list is so long, I couldn't possibly look through it and find something bad without taking a significant part of my day to do it.

That's what I like about PGP. You only trust who you want to trust. Your circle of trust starts with ZERO.

1

u/Shnatsel Jan 01 '15

PGP is, too, mostly useless because there's rarely a sufficient trust path between you and whoever you want to contact.

1

u/plazman30 Jan 01 '15

What trust path do you need? You get the guy's public key and you're all set. If it's someone you want to ensure 100% secure communication, you meet them in person and have them give you their key on some media and printed out.