Author: Drak 2013-12-08 21:07:54
Published on: 2013-12-08T21:07:54+00:00
On 8 December 2013, Gregory Maxwell expressed his concerns about the security of SSL certificates. He explained that there are many certificate authorities (CAs) that will issue a certificate to anyone who can respond to HTTP requests on behalf of the domain from the perspective of the CA. This means that someone could MITM the site and intercept traffic once the CA has signed their certificate. Simple verification relies on being able to answer the email sent to the person in the whois records or standard admin/webmaster@ addresses to prove ownership of the domain. However, bitcoin.org should obtain a certificate that requires identity verification for the person/org who is applying as they are more expensive. Drak, in response, mentioned that you cannot MITM SSL connections without causing a browser warning. However, some people are performing BGP redirections on a massive scale, which is a problem since BGP was designed on implicit trust. While the CA system is not foolproof, it is what we have. One CA was caught issuing a bogus certificate on purpose, resulting in CA certificate revocation and the entire company being blacklisted from Firefox and Google Chrome forever. The security agencies did not get bogus certificates issued in the Lavabit case, but they still got court orders or other deception to get hold of the encryption certificates of their targets instead of issuing their own so they could listen in. The CA system is not full proof, but it is what we have. Similar arguments have been made against the use of identity certificates for Bitcoin, but that hasn't stopped its inclusion in the Bitcoin payment protocol. Drak concluded by mentioning that he is quite passionate about this area, and it's important for him to be clear.
Updated on: 2023-06-07T22:04:29.544931+00:00