TTP means Trusted THIRD Party

Posted in Certificate Glitches, Networking Faux Pas, Crypto Plumbing on December 7th, 2011 by Rodney

Check out https://plus.google.com. It’s got a certificate for “*.google.com”. Wildcard certs may be the “store the used control rods in the attic and forget about them” technical trick of the certificate world. But wait, it gets better. This was issued by the “Google Internet Authority”. This presumptuous name describes a Certificate Authority, operated by Google (a/k/a google.com), that is in turn signed by a GeoTrust root.

Uh, guys, the point of certificates was to introduce a “trusted third party” (see Wikipedia definition or use BING to search for the term yourself…)

When the company running the web site issues the cert for a public TLS-protected website, the point was to be able to trust it because SOMEONE ELSE was the trusted third party. That’s why they are the THIRD party (not the first party, the browser user, called the “relying party” in certificateSpeak, or the second party, the private key holder of the site being accessed via “https”.)

Other sites do this. Akamai has in the past (and may still) practice this “I’m the second party and the third party” stunt.

Is this bad? Yes, this is bad. There’s no trust here. You’re only trusting the web site operator. If they are compromised, or go rogue, you’ve got no recourse. Revoking the certificate is no longer a defense. Trusting the root is no longer a defense. And, it implies these retail certificate authorities will take money for all sorts of crazy non-trust-delivering practices.

Trust was SUPPOSED TO means “trust the web site operator”

Posted in Certificate Glitches, Networking Faux Pas, Crypto Plumbing on December 7th, 2011 by Rodney

Check out this . Note the hostname mismatch (it’s got a GeoTrust cert for www.adgrafics.com. Note the WEB TRUST seal in the upper right corner. Click on that, let Chrome kindly translate (appologies, I don’t read Russian or Ukranian.) Note the seal is from “https://webtrustukraineseal.com” (confused yet?) and THAT says “Verisign Trusted” (Verisign != GeoTrust.) Note also the default https://www.certificatesigningrequest.com:8443/ Plesk self-signed certificate.

So… you should trust these certificates? From several different CA’s, and from a site that uses self-signed certificates? Not to pick on Symantec’s Ukrainian trading partners… but really, are we supposed to trust these certificates? When the vendors are this sloppy?