The Presentation
The inimitable Zooko recently made me aware of an excellent presentation about HTTPS: "It's Time to Fix HTTPS", by Chris Palmer.The presentation is both hilarious and illuminating; I highly recommend you view it right away. It's not saying anything that I haven't been thinking for a very long time. Except the thing about how IE can silently add certificates to your root CA store, that was definitely new, and a little depressing. But this is a somewhat esoteric topic and it needs to be made more popular for the everyday user. Sexy, even.
A Brief Review
(But seriously, go read the slides, they're more entertaining.)Internet security is based on trust. The math behind modern cryptography doesn't ensure anything beyond that you're talking to someone that holds a particular special secret ("private key"). You can verify that the party you're talking to has the same key as the one you talked to last time, and that a particular private key corresponds to a particular public key, but that's about it. The public key can be published for everyone to see without risking any of the secrets being sent, but you still need some way to determine whether the public key actually belongs to the person you want to talk to. So, in order to have a secure system, you have to layer some rules on top of that which give you some way to know whether that private key corresponds to an identity that you care about and trust.
The current system goes something like this: each web browser vendor decides, more or less at random, on a group of entities we will all trust completely. By virtue of the trust of the software, they become the authorities who can decide whose public keys are valid. Actually, a public key isn't quite enough: you need a key plus some metadata about the person sending it: we call this a "certificate". So these entities are termed "certificate authorities". The browser vendors tend to decide on the same group, because there's a lot of social pressure to maintain a list that makes sense (and also, anybody who gets accepted by one browser but denied by another can't really sell certificates: the whole point of this exercise is to sell things that make the little lock icon come up, so you know your web shopping cart is "secure").
The problem with this system is that almost all of these "completely trustworthy" entities are enormous companies or, possibly even foreign governments, which have diverse motivations and huge amounts of legitimate business to conduct, making it very hard to spot a small amount of malfeasance. (Although there is some good news: people do notice, and they freak the hell out when they do; so at least there's some policing of the current system.) One compromised certificate authority (and there are lots and lots to try and compromise) means a complete "game over" for everybody who uses a web browser and trusts the little lock icon.
Basically there's no such thing as "completely trustworthy". There's only: do I trust you.
The Next Step
The solution that Mr. Palmer proposes is extremely similar to the one which I thought I originally devised in about 2004, but probably was floating around in the security zeitgeist even before that. It's a combination of 3 general principles:Trust On First Use
Basically, the first time I see you, on the internet, it's unlikely that you're trying to trick me. So you can give me any old public key, and I'll accept that it's you.Mr. Palmer gives this one a catchy pseudoym, "TOFU", which I quite like (and I guess is pretty widely known at this point).
Persistence Of Pseudonym
The important point is that then I remember that it's you, forever, so it's very hard to attack our communications after that point.I'll come up with a name for you (let's say "Bob Smith" or "The Most Secure Bank In The World Dot Com"), and my software will make sure that it sticks to that public key. You can potentially tell me that your key has changed, but you'd better be prepared to present your old key, otherwise I have to get re-introduced to you, and now I'm suspicious that something may have been fishy. Especially if some other thing shows up and say "Hi, it's Bob Smith" (with the correct, old public key) - "Hey, who's this guy?"
This is referred to as "POP". Also pretty catchy.
Mesh Overlay Network Keysigning
The third concept Mr. Palmer refers to as a "trustiness metric" which includes "perspectives", and says "You can't fool all of the people all of the time". He includes some other stuff in his trustiness metric here, but I'm going to extrapolate from that sentence:It's really, really easy to sit down in a café and intercept some of my network traffic. It takes about 2 minutes to collect a dozen passwords this way, on today's mostly-not-encrypted internet. So it would be very easy for someone to break this system if all you had was a little re-introduction warning; users might not understand it and just click anyway, and then it's just as broken (if not worse) than the current model; at least in the current model, normal users don't usually get those warnings, and they're "safe" if they're looking for the lock, but in this new model, users would get them for all new secure introductions. So we need something better.
It's not so easy to sit down in a café and intercept network traffic from me and also intercept traffic from my friend, on a different network, doing a different thing. You have to know where my friend is. You have to be able to intercept our pre-arranged secure communication (I already remember all my friends keys when I first see them, you'll recall). If you're a casual attacker who just wants to sniff a couple of credit card numbers at the local starbucks, you probably don't have the resources to do that, even for a single individual.
It is definitely not easy to figure out where every single one of my currently-online friends - let's say Facebook friends, because you can maybe they finally care about security now - is online from, and also attack their networks simultaneously, to provide exactly the same bogus first-introduction certificate to Super Secure Bank Dot Com. This is a level of sophistication and coordination that not even most governments can muster.
So if we had a reasonably available mesh overlay network, where I can tell my friends, and my friends can tell their friends (etc forever) about first-introduction key correspondence with DNS names, and legitimate changes to keys where the site operator has had a security problem, then we could address many of these issues much more robustly than we can today. It might not be perfect, but it would silently work often enough that it would be much better than today's default of "bah, I don't know why you're getting the browser warning; just use HTTP".
Badump Ching
If you've been paying attention I think you can see where I am going with this.We (those of us in the open source hipster security noosphere) need to popularize this concept, because it's not that hard to implement, people keep re-inventing it everywhere, it's mostly just about getting some browser vendor to think it's a good idea.
The acronym is TOFU POP MONK, so clearly we need a vegetarian monk - buddhist seems most likely - who sings pop songs about how great tofu is. We need it to go viral on the you tubes, and any other tubes that are appropriate.
(Graphic design nerds, and sports racers of all stripes, start your engines. I challenge you. Show me some awesome macroable meme images starring the Tofu-Pop Monk. I will post any particularly compelling ones here.)