Delivery-Date: Mon, 05 Jan 2015 14:30:16 -0500
Return-Path: <tor-talk-bounces@lists.torproject.org>
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on moria.seul.org
X-Spam-Level: 
X-Spam-Status: No, score=-3.0 required=5.0 tests=BAYES_00,DKIM_ADSP_ALL,
	DKIM_SIGNED,FROM_EXCESS_BASE64,RCVD_IN_DNSWL_MED,RP_MATCHES_RCVD,
	T_DKIM_INVALID,URIBL_BLOCKED autolearn=ham version=3.3.1
X-Original-To: archiver@seul.org
Delivered-To: archiver@seul.org
Received: from eugeni.torproject.org (eugeni.torproject.org [38.229.72.13])
	(using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by khazad-dum.seul.org (Postfix) with ESMTPS id D930D1E03A7
	for <archiver@seul.org>; Mon,  5 Jan 2015 14:30:14 -0500 (EST)
Received: from eugeni.torproject.org (localhost [127.0.0.1])
	by eugeni.torproject.org (Postfix) with ESMTP id 01E4632734;
	Mon,  5 Jan 2015 19:30:12 +0000 (UTC)
Received: from localhost (localhost [127.0.0.1])
 by eugeni.torproject.org (Postfix) with ESMTP id 61ED73259A
 for <tor-talk@lists.torproject.org>; Mon,  5 Jan 2015 19:30:08 +0000 (UTC)
X-Virus-Scanned: Debian amavisd-new at 
Received: from eugeni.torproject.org ([127.0.0.1])
 by localhost (eugeni.torproject.org [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id mjfYk4_1JgTq for <tor-talk@lists.torproject.org>;
 Mon,  5 Jan 2015 19:30:08 +0000 (UTC)
Received: from scarlet.richardwhiuk.com (scarlet.richardwhiuk.com
 [178.18.118.69])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by eugeni.torproject.org (Postfix) with ESMTPS id 1825B32524
 for <tor-talk@lists.torproject.org>; Mon,  5 Jan 2015 19:30:08 +0000 (UTC)
X-Greylist: delayed 626 seconds by postgrey-1.34 at eugeni;
 Mon, 05 Jan 2015 19:30:08 UTC
Received: from localhost (localhost [127.0.0.1])
 by scarlet.richardwhiuk.com (Postfix) with ESMTP id DCFA8FDB17
 for <tor-talk@lists.torproject.org>; Mon,  5 Jan 2015 19:19:38 +0000 (GMT)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=whiuk.com; s=dkim;
 t=1420485578; bh=nISYyEsEfwdVUwcGwbDF0pyT52MWhNCrDaxDMDs4uLo=;
 h=To:From:Subject:Date:From;
 b=Ze4DCTFTH+0Uud+75EvqXJiAsSKZbw1+YLMs3uga+EugCo2CfqGe9va1e41UoDR6/
 OrqnaylGxUicyE6sGSUtC34p/yoxd339Eev4xw6+0rKkgR2H5woMT88Dqwa8lg8oLx
 2CquhA3csrilvVz5WlfcxUwNNPv+/5uH7jPvymiU=
X-Virus-Scanned: Debian amavisd-new at whiuk.com.
Received: from scarlet.richardwhiuk.com ([127.0.0.1])
 by localhost (scarlet.richardwhiuk.com [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id BQa4pg-1APlY for <tor-talk@lists.torproject.org>;
 Mon,  5 Jan 2015 19:19:36 +0000 (GMT)
Received: from [192.168.1.70]
 (host86-163-125-210.range86-163.btcentralplus.com [86.163.125.210])
 (using TLSv1 with cipher RC4-MD5 (128/128 bits))
 (No client certificate requested)
 by scarlet.richardwhiuk.com (Postfix) with ESMTPSA id 98B4AFDADA
 for <tor-talk@lists.torproject.org>; Mon,  5 Jan 2015 19:19:36 +0000 (GMT)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=whiuk.com; s=dkim;
 t=1420485576; bh=nISYyEsEfwdVUwcGwbDF0pyT52MWhNCrDaxDMDs4uLo=;
 h=To:From:Subject:Date:From;
 b=ejxJytpN4tt2OXIO2IGf+9fVWkXUW3JIv+vvE3R1f1rBhaVB/PKmogP15KWaYE1CX
 NIzGsyg+NIUzDZWSa9/B/SO2LEVERIIZ0aL24rQWKyRoIUaIEUfz95bkUeJ7xa0eph
 s99hXUKKFJfymWokpVL/EYvFq3tnJC95OCZr1yZ4=
To: tor-talk@lists.torproject.org
From: "=?utf-8?B?UGhpbGlwIFdoaXRlaG91c2U=?=" <philip@whiuk.com>
Date: Mon, 05 Jan 2015 19:19:36 +0000
MIME-Version: 1.0
Message-Id: <20150105191938.DCFA8FDB17@scarlet.richardwhiuk.com>
Content-Disposition: inline
X-Content-Filtered-By: Mailman/MimeDel 2.1.15
Subject: Re: [tor-talk]
 =?utf-8?q?How_much_of_SSL_CA_protected_traffic_is_read?=
 =?utf-8?q?_by_NSA_etc=2E_according_to=2E=2E=2E=3F?=
X-BeenThere: tor-talk@lists.torproject.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: tor-talk@lists.torproject.org
List-Id: "all discussion about theory, design,
 and development of Onion Routing" <tor-talk.lists.torproject.org>
List-Unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-talk>, 
 <mailto:tor-talk-request@lists.torproject.org?subject=unsubscribe>
List-Archive: <http://lists.torproject.org/pipermail/tor-talk/>
List-Post: <mailto:tor-talk@lists.torproject.org>
List-Help: <mailto:tor-talk-request@lists.torproject.org?subject=help>
List-Subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk>, 
 <mailto:tor-talk-request@lists.torproject.org?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: tor-talk-bounces@lists.torproject.org
Sender: "tor-talk" <tor-talk-bounces@lists.torproject.org>

> Note that they'd really only need command of *one* CA that is trusted to pull it off (see also the trick that corporate web appliances use to transparently intercept SSL) .. although that would make them likely to get caught at it. 

Google at least check the root certificate that Google provides and ensures it's correct:

"Subsequently, a certificate for *.google.com which was issued by their Root CA was found in the wild, and reported by an astute user who was using Chrome as his browser. Chrome has extra checks built in for accessing Google sites, and displayed a warning to the user."

So my feeling is you'd need to compromise the actual certificate for Google and can't rely on having an arbitrary root certificate. 

In any case, they don't need to compromise a root CA. They already have one in your browser I think. There are various US government agencies in there I think.

The larger point here is that root CAs are too powerful. I might trust a CA for .mil but I shouldn't have to then trust them for everything. The military might have the reverse view on who should be able to sign .mil

We need to have a serious discussion about whether all the root CAs can be trusted for literally everything. 

Also maybe domains can be multi-signed so I can say well I trust that root but not some others. 

Web certificates is broke, certification itself might not be fundamentally flawed.

Just a few thoughts... 

Philip Whitehouse

-- 
tor-talk mailing list - tor-talk@lists.torproject.org
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

