SSL unsafe for users?

"99% of SSL users have no idea how SSL works and consequently make informed decisions"

Browser manufacturers try to make things easy for users but end up diluting the security properties of the hierarchical trust model.

A lot of talk in recent years on the cryptography mailing list indicates that this model is too broken and perhaps should be replaced with an ad-hoc mechanism, such as the SSH model, with all web servers installing _some_ sort of certificate by default--even self-signed. The thoughts are that some confidentiality protection with reasonable MITM detection is better than so few sites supporting encryption since they don't want to pay Verisign blood money for a "real" certificate.

You'll notice on my site that I have always used my own cert. I should probably regenerate one that is not expired...

-----Original Message-----
From: InfoSec News [mailto:[email protected]]
Sent: Monday, March 24, 2003 12:39 AM
To: [email protected]
Subject: Re: [ISN] Is SSL safe?

Forwarded from: Kurt Seifried

None of this really matters because 99% of SSL users have no idea how
SSL works and consequently can't make informed decisions when faced
with attacks such as:

1) Older SSL clients that don't check certificate constraints, i.e.
CAN-2002-0828, CAN-2002-0862, CAN-2002-0970, CAN-2002-1183,
CAN-2002-1407 and so on. If you don't understand what this sentance
means you are potentially vulnerable. I have yet to see a GOOD plain
english description of this problem that my mother would understand.

2) Verifying certificates that are out of date or issued to the wrong
common name (i.e. hostname). This happens a lot, my web based banking
provider (one of the big 4 banks in Canada) used an out of date SSL
certificate for about a week last year. Perhaps an insider attack at
work, perhaps an innocent mistake, I never got an answer out of them.

3) Verifying that certificates are issued from a trusted provider.
Most common web based SSL clients (like Netscape, IE) have over 100
root certificates. Have you ever heard of "Certisign Certificadora
Digital Ltda." (doesn't expire until 2018) or "IPS SERVIDORES" (good
until 2009). It seems to me that an intelligent criminal could subvert
one of these small firms (hostile takeover, get employed there, etc.)
and then have a grand old time issuing certificates to themselves.

4) The eternal "who cares about SSL" argument, web servers and back
end infrastructure is so poorly secured that most times an attacker
can spend a week breaking in and get a few (tens, hundreds, etc.) of
thousands of credit cards with all the personal data in one fell
swoop. This applies less so against "secure" corporate/gov/mil/etc
infrastructure like SSL encrypted POP email, against which targeted
SSL attacks are useful (to gain a password to gain further access,
etc.).

5) All the old old stuff I covered in:

http://seifried.org/security/cryptography/20011108-end-of-ssl-ssh.html

and

http://seifried.org/security/cryptography/20011108-sslssh-followup.html

Which still largely applies. *SIGH*.

Kurt Seifried, [email protected]
A15B BEE5 B391 B9AD B0EF
AEB0 AD63 0B4E AD56 E574
http://seifried.org/security/