Hacker News new | past | comments | ask | show | jobs | submit

Horible public key tricks

https://maurycyz.com/projects/badcert/
219Curiositry | | 73 | HN
loading story #50437336
knotimpressed | parent | next
The linked pdf at https://tom7.org/httpv/httpv.pdf is extremely long but a great read if you enjoyed the article.
loading story #50436439
cute_boi | parent | next
"the way, to sign a piece of software, you need to pay an extortive $100/year fee to Apple"

This is the main reason I hate these notarization. And the worst thing is if you want to work on some software that require network extension, you can't even do it without paying apple $99 a year. There are workaround like turning off SIP, but it isn't recommended.

loading story #50436490
loading story #50435796
loading story #50436251
jrmg | parent
I came here to say the same thing! I’m not sure I have the author’s vehemence, but I enjoyed the read.

Longest ‘paper’ I’ve read in ages, I’m slightly ashamed to admit.

loading story #50441669
loading story #50438362
tptacek | parent | next
All serious attackers are man-in-the-middle attackers (usually by tricking victims into diverting their own traffic, not literally by inserting themselves into the network path). Passive-only attackers went extinct along with the backbone-connected Sun servers that were used to launch those attacks.

I don't so much care about the rest of this analysis, but you can't call an unauthenticated TLS session "secure".

stingraycharles | parent
> usually by tricking victims into diverting their own traffic

What does this mean practically? Getting a VPN profile installed ?

loading story #50434907
loading story #50434920
sam1r | parent | next
Tip: select the the ‘tty’ mode prior to digging in.

I’ve never felt a more relaxed feeling (easy on the eyes) while reading any blog in comparison.

icedchai | parent
Yes! It takes me back to the amber VT-220 terminals at school. I might have the model wrong.
loading story #50436787
loading story #50438638
arcfour | parent | next
>Nobody checks your private keys

You're implying that they should???

taspeotis | parent
I suspect private keys should receive a nominal check, that they can't be guessed by smashing the number 4 on a numpad.
loading story #50435070
1vuio0pswjnm7 | parent | next
"... and the whole system doesn't even work because certificates are issued over plaintext connections, and trusted certificate aurthorities[sic] use very secure keys like "4""

And the CA certificate is "self-signed"

Meanwhile under this "Web PKI" the www user is by default discouraged and/or blocked from using self-signed certificates she herself creates

Someone else decides who she must trust. It's not optional

For example, for a number of years someone else told her she must trust eMudhra

loading story #50436509
kaslai | parent | next
> So, I've always been somewhat annoyed at SSL/TLS. It requires everyone to go through a complex "ACME" dance just to put up a public website. Worse, certificates expire every few months, so it's not a one and done thing: even with automation, maintaining a certificate requires care to ensure the ACME client always has access to DNS records or the web server.

Not actually all that long ago, people faced down the prospect of $1000+/year E.V. Verisign certs that involved faxing legal documents, phone calls, and other probing. Many jumped for joy when LetsEncrypt was finally mature enough for the mainstream. Kids these days don't know how good they've got it...

jrmg | parent
Yes, but back then SSL/TLS wasn’t a requirement to publish anything on the web. You just needed a domain, and IP and a web server. The minimum bureaucracy you have to do now is much greater.
lacoolj | parent | next
I cant get past the title spelling
jansenmac | parent
Yes. It’s horrible.
loading story #50435797
mplewis | parent | next
>the whole system doesn't even work

Yeah, I saw a fire hydrant leaking the other day. Time to tear out all the plumbing, the whole system doesn't even work!

| parent | next
{"deleted":true,"id":50435906,"parent":50434264,"time":1794283307,"type":"comment"}
geekgod382 | parent | next
I don't understand the math. What does plaintext^e mod n actually do?