| |||||||||||||
Good idea, but don't expect too muchGood idea, but don't expect too muchPosted Feb 18, 2010 9:31 UTC (Thu) by khim (subscriber, #9252)Parent article: Trust, but verify
While those of us who are technically inclined will be able to use a web of trust if desired, it would be nice one day if our parents, siblings, and others who aren't so technical could also stop relying on potentially corrupt organizations for their internet communication security. This is stupid goal for two reasons: Think about it this way: you can not live without trusting "central authorities". You trust your supermarket when you are buying food, you trust your car mechanic when you are driving car, you trust your electric company when you turn your computer on and so on. Heck, a lot of guys you trust based on central authority can kill you! Not just your medic, but you gas-man! It's neither usable nor feasible to play these "web of trust" games in real world - why cyberworld must be any different? Sure, we need people who'll catch "potentially corrupt" authorities when they'll become "actually corrupt" and expose them - just like we need them in our non-computer related life. But to expect that Joe Average will play these "web of trust" games... this is not just stupid, this is unfair! If "central authorities" model is good enough for you to entrust your life then why it's not good enough to entrust your files? Do you value your life less then you ssh account?
(Log in to post comments)
Good idea, but don't expect too much Posted Feb 18, 2010 11:31 UTC (Thu) by dion (subscriber, #2764) [Link]
I may have to trust my doctor not to poison me, but that's far from being the same thing as trusting that a faceless, profit motivated, cooperation on the other side of the world to accurately bestow trust on systems and people I need to talk to.
IOW: This is a silly argument, you cannot possibly compare the threat scenarios of Internet connected computers with physical situations.
I also doubt that web-of-trust is going to be a mainstream solution, but I'm far from being happy about the current highly centralized CA regime.
Good idea, but don't expect too much Posted Feb 18, 2010 14:04 UTC (Thu) by andypep (subscriber, #33588) [Link]
I wonder. A very common way of selecting a tradesman is to ask around among your friends. In other words, word of mouth recommendations are very much alive and well, even now. So it might actually work if it could be made easy enough to build the web of trust through friend networks.
Good idea, but don't expect too much Posted Feb 18, 2010 16:05 UTC (Thu) by drag (subscriber, #31333) [Link] Yeah.If you blindly trust a doctor your doing it wrong. If you blindly trust a mechanic your a setting yourself up. When I need a car worked on I either do it myself if I can manage (oil changes, brake pad changes, etc etc.. things that are easy) or I have very specific couple of shops that I know that are trustworthy. I am willing to put myself in a great deal of inconvenience in order to go to a mechanic I can trust. They are worth their weight in gold and very often carry a premium for their services. Same thing with Doctors. Don't blindly trust them. Do not believe what they tell you is true, do not trust the drugs they prescribe to you are safe. You look up that stuff on the internet. I mean, seriously, why do experts always recommend for you to get a second opinion on anything that is remotely serious? Plenty of times doctors have ignored symptoms that ended up killing patients. They prescribe drugs that kill their customers. Anybody with half a brain knows that they have to rely on their own judgment for many things since even if the people they are working with are wonderful and have their best interests in heart they can still make mistakes. That is the 'Trust But Verify' for doctors.. 'Get a Second Opinion'. That is fundamental requirement. Is it foolproof? NOPE. But it's important. If you have a problem and you get something that sounds funny from your current doctor then you hire a second, unrelated, doctor to get his opinion. And there are times I've gotten unsafe food from the supermarket. Had stuff go rotten or be rotten in containers even if the date on the packaging says otherwise. I know that different stores are more trustworthy then others and some stores have fresher food or higher quality produce then others. Hell you can see that in the rise of 'Whole Foods' types stores were they provide higher quality food then the average supermarket. Not all of them are equal. And on top of that some of the food they sell is not safe to you. Things like IceCream, while a treat, have a very similar effect to a slow poison on the human body. If you blindly choose your foods on what looks good and what tastes good then you're going to end up fat and dead. So on and so forth. It's not that these people are evil. But it's simply a requirement of a healthy society that it's citizens have a healthy skepticism and be willing to put the effort into understanding what is going on around them. It's not that you don't trust them. Its that you do what you can, in your limited way, to make sure that you can trust them. A central authority like Verizon can actually make everything worse. Anybody with some cash can pay to get 'trusted'. It does not matter who. A official government-recorded corporation can be created with as little as 200-300 dollars and a couple signatures. A P.O. box or trustee can be a official address. They give the illusion that a website is safe, when really you have no idea. That authority can be used to shield and make dishonest people seem legitimate. It's used all the time. Drug companies use the FDA to make their stuff seem safe, when it really is not. Same thing with food. People trust the FDA to protect them so some dishonest people use that perception against you. So things like central commercial certificate authorities do not have the ability, desire, or resources to make sure that a website is 'safe'. All the cert means is that the company is legit enough to pay somebody money to sign their cert and that you probably have secure communications with that host. Hell.. they could be completely honest folks, but have some crappy webserver that allows for cross sight scripting attacks. When you buy something online from a store you've never used... do you not google around and see if you can find some sort of history or users complaining about that store? Do you not check your accounts to make sure that payments taken out are correct? That is 'trust but verify'
Good idea, but don't expect too much Posted Feb 18, 2010 16:08 UTC (Thu) by drag (subscriber, #31333) [Link]
Er.. ya. s/sight/site/g <doh>
Good idea, but don't expect too much Posted Feb 18, 2010 21:10 UTC (Thu) by martinfick (subscriber, #4455) [Link]
Your examples are not typically considered "central authorities".
There are many supermarkets and many independent supermarket companies, not very central. But even then, many do refuse those "authorities" and I wouldn't call those who refuse to shop in supermarkets "stupid".
A single car mechanic is not at all a central authority. Perhaps a dealer is a bit more like one (but not really one), and those who tend to trust central authorities are more likely to be those who would take their car to a dealer instead of independent mechanics. Surely those who don't shouldn't be called "stupid", should they?
Some people trust there electric company, some don't. Some buy their own backup generators, some have UPSes on their PCs, many more at least have surge protectors... maybe they don't trust the central authority? After all, utility companies are one of the most complained about monopolies, particularly because most people are forced to use them even when when they don't "trust" them!
Clearly recommendations play a huge role in the real world, usually a bigger one then central authorities, so why would you think they should not translate well to the computer world? Luckily in the real world, most people can figure out which models they prefer. But in reality, the central authority model really is just a small piece of the web of trust model, wouldn't it be nice to extend that web of trust to smaller entities also?
Interesting how people skipped my argument entirely... Posted Feb 19, 2010 7:40 UTC (Fri) by khim (subscriber, #9252) [Link] Your examples are not typically considered "central authorities". Because people like to feel they are free and ignore reality, or why? There are many supermarkets and many independent supermarket companies, not very central. But even then, many do refuse those "authorities" and I wouldn't call those who refuse to shop in supermarkets "stupid". I never said they are. I said that it's stupid goal to try to make everyone refuse central authorities and use small local shops instead. This model just does not scale. Your doctor has a license, your car dealer has a license, your electric has certificate, etc - these are your "central- authority issued certificates". Some have self-signed certificate (your friend who has no licenses at all but does terrific work fixing computers, for example), but most use "central authorities". You can decide to ignore some central authorities (like you can choose to ignore CNNIC), but it's not possible and not feasible to ignore all of them. Clearly recommendations play a huge role in the real world, usually a bigger one then central authorities, so why would you think they should not translate well to the computer world? Recommendations are absolutely important. Vital, even. But Web-Of-Trust is not a that. It's some complex technical tool designed to automatically determine if you should trust someone or not. Most people have neither need nor abilities to properly use it. But in reality, the central authority model really is just a small piece of the web of trust model, wouldn't it be nice to extend that web of trust to smaller entities also? KISS principle. Web-of-trust model is complex and opaque, central authority model is simple and transparent. In security it's often better to have simple and rigid model rather then complex and flexible one. It's Ok to have some web-of-trust advisory (like phishing filters employed by modern browsers) but even to try to replace central authority model with this... it's neither feasible nor desirable.
centralized trust models are a weaker, insecure subset of distributed trust models Posted Feb 22, 2010 10:35 UTC (Mon) by dkg (subscriber, #55359) [Link] (disclaimer: i'm quoted in the article, and i'm a contributor to the monkeysphere project) I appreciate your commentary, and especially your skepticism about changing core infrastructure. These things need to be taken seriously. I hope you'll train your skepticism on the existing problematic systems as well. khim wrote:You can decide to ignore some central authorities (like you can choose to ignore CNNIC), but it's not possible and not feasible to ignore all of them. Why is it infeasible to ignore any of them that you distrust? Today, it's because of the inherent bias in the structure X.509 certificates, because any certificate can only have one issuer. With the current infrastructure, you simply can't express the idea of "I only trust FooCA's certifications if they're corroborated by some other entity". And if you decide to say "I don't trust FooCA's certifications at all", your only clear option in the current regime is to not visit services certified by FooCA, because there is no way that the service could be concurrently certified by another CA which you do trust. But what if more than one CA could certify a service? khim wrote:Recommendations are absolutely important. Vital, even. But Web-Of-Trust is not a that. It's some complex technical tool designed to automatically determine if you should trust someone or not. OpenPGP's Web-of-Trust is actually not about automatically determining whether you should trust someone or not. It's ultimately about deciding whether someone is who they claim to be, just like that Other PKI, X.509. The WoT uses your own indications about who you trust to identify other people (or services) and then automates the process of binding those identities to public keys, which are bound in turn to your communications. If this is confusing, it might be because current implementations and documentation don't do a good job of separating out the concepts and the terminology. I agree that's a problem, and it needs to be fixed. But the questions you need to be able to answer to use the WoT are very much within reach of ordinary humans. As a baseline for use of the WoT, you need to be able to answer one question:
The final concept (about matching keys) does require a bit of sophistication -- it means you need to understand that some digital object called a "key" exists, and can be used as a means of identifying people (or other entities). And it means you need to know how to compare the fingerprint of a key: this just involves reading a series of letter and numbers and making sure they match; most people can do this. khim wrote:Web-of-trust model is complex and opaque, central authority model is simple and transparent. In fact, if people want central authorities, it's trivial to implement them in a WoT. Simply mark all the central authorities your tools already implicitly "trust" as being entities you feel you can rely on to identify another party. Now, your WoT is exactly as simple and transparent as a hierarchical model. But if you decide that something is wrong with that model, you have a way to address the problem. What could be wrong with the hierarchical model? Try asking people who they actually trust with the ability to compromise all of their networked communications. Mozilla Firefox 3.5 ships with entities like the dubious GTE CyberTrust Global Root (using a 1024-bit RSA key with an expiration date of 2018 -- 8 years longer than NIST recommends), governmental root certificate authorities from Taiwan, Netherlands, Japan, and soon China, and "too-big-to-fail" agencies with a history of corruption, simple incompetence or acquiescence to corporate or governmental bullying like Network Solutions, Equifax, or Verisign. You don't have to distrust all of these entities to think this arrangement is suboptimal. You only need to distrust one of them. It's a weakest-link arrangement. The solution to these problems is not to force users into blind "trust" arrangements that are inherently insecure. It's to make sure users have access to clear, comprehensible information about who they are relying on to make identification decisions, to make it easy for end users to reject untrustworthy middlemen, and for people who don't understand the system to rely on people or groups they actually do know and trust to make identity certifications (even if they turn out to be delegated ones). As far as i can tell, this isn't possible with the dominant technical infrastructure for the central authority trust model (and it should be noted that X.509 itself is also neither simple nor transparent). We can do better, and we should.
Good idea, but don't expect too much Posted Feb 18, 2010 22:32 UTC (Thu) by iabervon (subscriber, #722) [Link]
In a lot of real-world interactions, the trust is rooted in an established direct relationship. When I contact my credit card company, I do so by calling the phone number printed on my credit card. When I mail them a check, it goes to an address that I am familiar with from when I opened the account. Also, when they receive the check, they actually request an electronic funds transfer from my bank, and my bank and my credit card company have identified each other from experience, from looking at the identifiers on my check, and by their government charters.
In none of these cases do the parties use an arbitrary trusted authority. Either they have shared information that they use to identify each other as being in an established relationship, or they have a specific body, with whom they have a direct relationship, that they use to introduce them to each other.
Terrific example Posted Feb 19, 2010 7:54 UTC (Fri) by khim (subscriber, #9252) [Link] When I contact my credit card company, I do so by calling the phone number printed on my credit card. Yup. And by doing this you blindly trust your telecom provider, your phone manufacturer, producer of the CPU for you phone, producer of the OS for you phone and so on. When I mail them a check, it goes to an address that I am familiar with from when I opened the account. But you use another organization certified by trusted authority - be it USPS or DHL. Heck, when you visit USPS or DHL office you trust the sign on doors - and integrity of this sign is guaranteed by central authority (called government)! In none of these cases do the parties use an arbitrary trusted authority. Sure they do. More often then not there are a lot of parties involved which are used because they are certified by central authority (they have a license from government or they are certified by some agency licensed by government, etc). It's good idea to use web-of-trust-like models to get a second opinion (today's browser implement it via different services designed to prevent scams), but to try to replace usual chain of certificates with web-of-trust model... that's just crazy.
Good idea, but don't expect too much Posted Feb 19, 2010 18:23 UTC (Fri) by dmag (subscriber, #17775) [Link]
> Think about it this way: you can not live without trusting "central
> authorities".
Agreed.
> You trust your supermarket when you are buying food, you trust your
Non Sequitur. Yes, most people's non-farming lifestyles force them to trust a supermarket. But the article was talking about an alternative to generic profit-driven CAs that FORCE you to trust ALL items signed by them. Just because you are forced to trust A supermarket, doesn't mean you are forced to trust ALL supermarkets. It's not an all-or-nothing model like CAs are.
The current way SSH operates is "everyone makes their own decisions on which keys to trust" (both clients and servers). Totally not secure unless you give everyone lots of security training. The web of trust idea allows a company to say to it's employees "you're approved on all our servers" and "you should trust all our servers". That's pretty cool. No tin foil hat required.
> It's neither usable nor feasible to play these "web of trust" games
Wrong. The opposite is true: It's not feasible to give EVERYONE the same level of trust.
Would you give a ride to someone on the street? Probably not, but you'd have no problem giving a ride to someone in your Yoga class.
Would you let a stranger into your house? Probably not, but you'd let in someone who is a friend of your mom.
Do you eat food from strangers on the street? No, but you probably eat the free samples at the grocery store (trusting that the grocery store isn't going to poison you).
Ok, only geeks use the term "web of trust", but it still exists in the real world.
> why cyberworld must be any different?
Just because we can't do something in the real world doesn't me we shouldn't do it in the cyberworld. Look at people with 1000's of friends in their social networks: They are much more likely to get a job by posting "I need a job" to their social network (cyberworld) than scanning the newspapers or asking a handful of close friends (real world).
|
|||||||||||||