Why the hell were indians entrusted with the keys to over half of the entire internet?
>>110126279browsers basically accept any valid cert from any CA that the browser knows is "trustworthy", they don't necessarily care which of those it's from. just one trusted CA shitting the bed like this jeet company is enough to basically let anyone spoof any certificate they want, even if only like 0.0001% of websites normally use a cert from that CA. basically the entire certificate system behind the internet is dependent on its weakest link, aka jeet tech
>>110126306Because even our grandma's have been indoctrinated with antinatalism propaganda
>>110126279the IETF wrote the procedure and did not specify how to distinguish keys generated for testing from keys generating for signing
>>110126279>half of the entire internetthey were trusted to it all, sirs
>>110126468Thankfully, a bold indian stepped in and made them look identical.
>>110126306Capitalism is to blame.Capitalism will always make people chase new large unexploited markets.
>>110126489he was just following orders
>>110126279It's cheap!
>>110126419>basically the entire certificate system behind the internet is dependent on its weakest link, aka jeet techthis is epicly disturbing, what do we do?
>>110126279... who do you think runs every tech company (aside from the handful of ai jews)
>>110126647>this is epicly disturbing, what do we do?You can roll your own certificates, but I only ever saw one person do that since you basically need every user to set you as a root CA
>>110126279Because indian salaries next question
>>110126279
>>110126838Please say syke omfg
>>110126279but saar
>>110126647Destroy all your devices and go offline permanently.
>>110126647You have to distrust a good percentage of certificates found in your browser. Don't rely on Mozilla or trusted 3rd parties anymore.Someone should set up a CRL (certificate revocation list) but instead of making it official, this is one that just distrusts certificates from the 3rd world.If anyone has some free time, they try to guess the private key of each of these certificates by iterating from 0 - 2^16 for each certificate (certificate cracking)
>>110126279Return to /pol/Upon going through the replies I found the objective was not good faith discussion but blatant racism. Go back.
>>110126419why haven't we come up with a decentralized way to run the internet? why leave the whole infra to central authorities and domain registrars and whatnot? we need more things like GNUnet
>>110126279Sauce?
>>110126838Not necessarily. They are also all under 256, so it could be an artefact of unintentional truncation somewhere in the pipeline.
>>110129575What does that solve?
>>110129613You can't just truncate keys. It's not a password you could change before encryption, they are two mathematically linked numbers. Truncation breaks that link
>>110129575Another anon reaches the conclusion for the necessissity of the world computer
>>110130396They keys (which is also the seed in ECC) was clearly truncated (or chosen in a retarded way, which is still possible obviously) before the generation of the public key.What exactly are you trying to say?
>>110126419>>110129575>>110130454CA trust model is broken by design, Tor literally solved this by putting the certificate public key in the domain itself, it's decentralized and uses the TOFU trust model (you bookmark the domain).But normaltards hate it because hurr durr onion domains are scary looking and you can't easily remember them boohoo.
>>110130459its not a truncation issue, all of the keys are numbers between 1 and 256, it's a jeet logic issue
>>110129575sure, there are various projects trying to decentralize the internet or run more decentralized servicesbut the corpo CA trust model is not going to be better if you decentralizein some ways it's more that you shouldn't want it at all. but they do for now in various ways.
>>110129509>>110130518You can do self-signed certificates and use the TOFU trust model, problem is that all browsers are kiked and will show a "this website is insecure and will steal your credit cards BE SCARED" message which is an absolute LIE as the TOFU model is perfectly safe and used by lot of protocols like SSH for example.
>>110129517Agreed.>>110129634Please stop being boring.
>>110130512???First of all they're not exclusive, second it's not what I'm saying at all.The emudhra tards clearly fucked up, the question is how. Was it because they thought 2^384 meant 2 to 384 or because of some intentional or unintentional thing that caused the randomly generated key to be truncated to 1 byte?If the key was "randomly-generated", the probability of them all falling under 256 in the first case is (254/382)^8 or just over 3%, while in the second case it's 100%, making the byte truncation more likely.
>>110130539perfectly safe for the corporations and the companies that by far mostly fund the browsers and the internet in general, and/or the retarded general public?various implementations of TOFU have a not so bad balance of compromises made for most of us here, sure, but the above usually cannot deal with i
>>110130586>254/382254/383*, and it's around 3.7%, my bad.
>>110130586>>110130600saar the izzat has already been redeemedwe'll never know how retarded they are unless they show us the code, which they would if they were like a white company such as cloudflarebut they aren't so speculating is completely pointless
blame the greedy corp retardsall of them btw, are jeets
>>110130539TOFU model is perfectly fine when you have an idea on what certificates to trust and you have their public keys/fingerprints already available. It does give the question of who to trust Opt-in, instead of Opt-out, which is good. The issue here is that you wouldn't have fingerprints of major CAs, which major websites sign on available readily, and getting them insecurely is another avenue of vulns. What they should do is make all the root CAs available by default, but let the user Opt-in to them through a TOFU model, as well as any other self signed certs.But the way that you phrased it though, I hope you're not connecting to any SSH server by blindly trusting any fingerprint anon.
>>110130609We can guess probabilistically. The correct call would be to compare (235÷383)^8 (~2%) with (238÷256)^8(~55%), instead of 3.7% and 100% I said earlier (because I'm retarded)
>>110130612Not really. emudhra's retardation is 100% their own, and SSL/TLS, which enables this retardation was formulated in the 90s before all this and without involvement by atleast the current day megacorpos.
>>110130654yeah we had no idea that the internet would also be run by retards back then, india's internet penetration in the 90s was extremely minimalthis is the same kind of situation as the south africans decommissioning their nuclear weapons before handing the government over to the blacks, we need to shut down global PKI and decentralize with zero trust as the default
I knew this was gonna happen the moment I realized fucking faggots in tech are willing to destroy Internet infrastructure in exchange for cheap subcontinental labor. Subcontinental slave labour probably feels like crack cocaine to these managerial retards.
https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c11
>>110126279I've found that rich Indians, especially those in tech, have an inordinate amount of power, and keep failing basic security practices because they hire their own kind (who are known to go above and beyond to not do their job).
>>110130593What do you even mean?TOFU is dead simple, you get the public key, you save it, next time you check if it matches.>>110130619The CA model should be abandoned entirely, it's centralized and based on trusting corporations and governments.You just get the fucking certificate from the server you connect to.>getting them insecurelyWhat?>by blindly trusting any fingerprintTOFU is literally trust on first use, by definition you trust it the first time.
>>110129613idk why >>110130396 is out to get you for going against the epic funny theory in the original image but I see it a lot lately and it is really annoying how people just roll with whatever they are presented as the true story
>>110130459Ah, I though you meant truncated after generating the other side of the pair, that would obviously break asymmetry. Yea doing it before would work
>>110130795Why you saying fuck me for?
>>110130789So tired I forgot to mention my entire point.Indians are good at marketing and sycophancy. Boomers are weak to that stuff. It's why they get handed the keys to the city.
>>110130823I guess I was saying truncation should not be dismissedpeople will do weird stuff trying to get things to work that is completely left-field of best practices
>>110130697The Root CA arrangement is just retarded, even without the involvement of Indians. It necessarily requires putting trust in any authority, which allows tjem to essentially spoof or orchestrate MITM attacks for literally any site/domain in existence. Check your browser for the root CAs. Amazon, Apple, Cloudflare, Google, Microsoft et al are on there. Do you fucking trust them for jackshit? Especially Cloudflare and Google, which also run their own, pretty popular DNS services. They essentially have a free pass to MITM any website they want for anyone that uses their DNS services. This system is malicious and retarded by default.Just like that epic games github dude, this Indian retardation is only highlighting a problem that already exists and has existed for decades.
>>110130793>TOFU is literally trust on first use, by definition you trust it the first timeI think you're not understanding what I'm trying to say. I'm asking you how would you fucking know whether to trust someone the first time around in the first place? Say you're trying to connect to epichaxorblog.ru for the first time and you're prompted with the signature. Ho will you verify it's from epichaxorblog.ru and not from some MITM attacker?And yes, Root CAs are retarded. Nobody challenged that.
>>110130878We should setup some sort of authority to establish a chain of trust for the certificates... a certificate authority perhaps?
>>110130887I'm not against CAs entirely. Like I said, TOFU can work as the basis of an Opt-in model. Browsers and OSes ship with the usual assortment of Root CAs as usual but they should be opt-in via TOFU, so you can weed out certificates from authorities you do not actually trust.
>>110130878You just do? Literally never had a problem with it.You could also use a directory if you really wanted but it should be a side channel not the trust model itself, or if you want the decentralized version of that you can do Web of Trust + TOFU.>>110130887>le chain of trustOnly usecase of that is giving control to corporations and governments, always was.
>>110130913>You just do? Literally never had a problem with it.I think you might genuinely be retarded anon. Just don't use SSL/TLS if you want to be careless, that's always an option.
>>110130919Encryption with TOFU trust model just work, no amount of gaslighting will change this simple fact.Meanwhile CAs are literally vulnerable to Indians and need you to cuck out to a centralized jew owned system.
>>110130853>This system is malicious and retarded by default.indeed, perfect system for US/Israel Intelligence
>>110130942TOFU works, but not the fucking way you just told me you use it, where you just hit [Y] on first connect blindly. If you want to fucking do that, it makes no difference from the current arrangement, even if emudhra's certs weren't revoked, because you would fucking click yes anyway you absolute fucking buffoon. Do you have any idea what you're saying?
>>110130919>Just don't use SSL/TLS if you wantYou literally can't, huge swathes of the internet block plain http traffic. The internet is probably less usable with no https than it is with no javascript.
>>110130967That's literally how TOFU works though, by definition, again "trust on first use", and if you want some extra assurance the first time you connect you use a side channel.Go and find me some hacks that happened because of it.How do you think TOFU works?
>>110130998>Go and find me some hacks that happened because of it.>visit con>oh hey we set up a site with maps and info at [website]>somebody sets up a fake one at the same time>visit it and click trustuh-huh
>>110130998Those "side-channels" you speak of are the intended route, aks sources you can trust to get the fingerprint before you make the connection via SSH.TOFU is supposed to be a confirmation mechanism for sources you already trust. It's for when I'm trying to connect via a new client while traveling, I can verify that the thibg I'm connecting to is what I want to connect to because I already have the fingerprint. If you choose to blindly trust any server anyway, there is literally no benefit to using TOFU because your first connection can be compromised.How is this news to you? Where did you even learn about TOFU? Did you think any of this through at all?
>>110130998>>110131071Do you think simply asking for add some confirmation actually magically makes things secure when you don't even read(or what (You) read doesn't matter to your decision) what it's asking you to confirm?Why the fuck do you think it's asking you to confirm instead of auto trusting everything in the first place anon? Do you tuink it'll tell you what website is compromised in the conformation prompt? This is the kind of stupidity the exact kind of shit that allows debacles like this to happen in the first place.
hello im retarded, whats the issue with the key? if someone knows its 4 does that mean that they can pose as a legitimate authority to make a website gib secrets?
>>110131146You could make a certificate for 4chan.org that browsers would trust without any kind of access to any 4chan's assets. Then you'd MITM someone and serve them the certificate, and they'd just see that they're browsing 4chan with a valid certificate.
>>110131146Essentially anyone can pretend to be any site as long as your computer trusts that CA as long as they can get you to connect to them, aka they have any method of sitting between you and your DNS resolver especially, which is trivial in some cases.
>>110131175>>110131189so if i type in 4chan.org then the internet tubes wont find the real 4chan?
>>110126306radical individualism, there is no collective identity anymore, its a blessing and a curse
>>110129634You’re the tourist.
>>110131221No, just generating a fake certificate doesn't do MITM. But if you for example spun up a free Wi-Fi near a coffeeshop, you could generate fake certificates for Facebook, Twitter, etc. and then MITM all of the traffic, and have people browse your honeypot sites and post their secrets in a format that you can read.
>>110131221Not necessarily. If your DNS resolver and the entire IP route is uncompromised, you may still be safe. But know that you won't notice if it's the DNS resolver is wrong, and there's no possible way to tell if the route is uncompromised.
>>110131062>shit that never happenedI'm talking about real documented cases.>>110131071>>110131098You clearly have never used Tor hidden services, they literally work this way and it was never a problem, the public key is the domain name, first time you visit you trust it from now on you know it's legit, same shit with SSH, and again never seen problem with it.Onion domains are based because they eliminate the two centralized bottlenecks of the web: CAs and DNS, this makes glowniggers seethe uncontrollably.>>110131175>You could make a certificate for 4chan.org that browsers would trust without any kind of access to any 4chan's assetsClassic cascading failure of a centralized system.
>>110131251>You clearly have never used Tor hidden services???I know how tor works, but you know that's a bad faith argument because including fingerprint and routing information in the domain isn't feasible for clearnet.Tor/Onion also still has the issue, it's just abstracted away. How do you know that the domain you're connecting to is the correct one in the first place? Obviously now you can choose to trust where you found about that site instead of any DNS or CA, which is a good thing. I am advocating for things like that if you scroll farther up, but what that anon in particular is saying about how he uses TOFU is just purely retarded and unsafe.
>>110131251>I'm talking about real documented cases.I think making users trust fake certificates on mitm is a bit too obvious and common of an exploit for it to get singled out and written about as if it was heartbleed
>>110131251>first time you visit you trust it from now on you know it's legitYou're using tor wrong my niggah. An onion site can MITM you if you simply trust it's content alone. I can set up an onion site mirroring some other onion site, change the identifiable elements and act as the middle man between you and the site. You'd fucking fall for that shit if that's your philosophy.
>>110131243>>110131248so the leet hack0r would have to convince someone to click a cool 4chan link to re-direct them to something else and the browser would just accept that its 4chan, the actual servers are not harmed but the anons browser can be given some pozzed code to run
>>110131345It's more like your netadmin or isp will setup a fake 4chan.org, which mirrors the real one, and then route all requests from your computer to the fake 4chinz, and then he can freely see what pr0n vidz you see on /gif/.
>>110131345>>110131373But yes he can also run pozzed code, and swap in his own modified malicious exes when you go to download one, and make your computer mine bitcoin for his wallet.
>>110131382>when you go to download oneOr when one of the programs on your puter updates. The possibilities are endless.
At the very least this proves that not all Root CAs are pozzed by the glowies, funnily enough. Because if the glowies had access to their signing key and they saw those stupid 1 byte keys, they'd revoke them themselves since they don't want just anybody to have the backdoors.Maybe there is hope.
