How people still think the PKI system is actually delivering security is beyond me.
We have zero idea how many bad certs like this may be out there (the nefarious people won't publish their results, after all), and yet a browser will still treat a Comodo cert as better than a self-signed one (it's identical to a self-signed cert, since Comodo is a known bad actor now). It's better than plaintext, of course, but that's not saying much.
"Dont throw the baby out with the bathwater."
We have certificate transparency, the browsers are more responsive and reporting, we have HPKP and other browser countermeasures.
Its not perfect but with enough eyeballs it can get close.
It provides meaningful security. CA signed clearly not the same as self-signed; Maybe you misunderstand what this means?
How is a certificate from Comodo any different from an self-signed certificate? There is actual evidence that they gave a certificate to a third party. That means you should treat any certificate from them as self-signed, because you cannot trust Comodo to do their jobs.
Assuming you understand the structural difference between a self signed and a CA signed certificate (ie: subject pubkey sig vs issuer pubkey sig respectively) the difference is clear.
You cannot determine provenance of a self-signed certificate. The sig matches the subject.
With a CA signed, the hold of the CA private key is the only source (with high probability), so it is attributable.
If you trust the company or not -- play with you trust store. Otherwise this is apples and oranges.
The only time when this comparison would be apt would be the compromise of the Comodo Private Key. This would allow anyone to issue Comodo certificates, thus removing their provenance.
Of course then their cert would be revoked and we wouldn't have this conversation.
I think I understand why you are not following what I am saying.
You prove that the certificate came from comodo, and only comodo. It can't have come from anyone else.
This isnt trust -- its public key crypto. Only the issuer could sign it. If you trust it or not, its irrelevant, only that it could only have possibly originated from there.
If you believe that the public key is truly owned by the subject because the issuer said so -- this is trust.
OK, but that's only helpful here in the sense that I could remove Comodo from my trust store, but nobody's going to do that. Not even me, and I'm the one complaining about this. What I can't do is have any confidence in the provenance of a CSR they signed: did it actually come from the organization that controls that domain? (That was what I meant by "provenance")
I still prefer the present situation (States or other resourceful actors might be able to MITM me on some sites) to the scenario without https (any random person whose Wi-Fi you connect to can trivially MITM everything)
I mean, sure, from a practical standpoint I agree we're stuck with PKI, but I think the browsers need to cull, and cull hard, the number of CAs that they trust (and, yes, that would absolutely suck for both CAs and their customers). They also need to be a lot more open to per-user, per-site cert pinning so that we can build trust networks on our own.
Most of the sites I connect to I don't actually "trust" in any real sense, so a third party assuring me they are who they say they are isn't useful information for me. (Am I being phished right now? It doesn't matter, because I don't trust news.ycombinator.com with any information I wouldn't also give to a phisher.)
Not really; self-signed certs prevent non-resourceful actors (to use your phrase) pretty well too, well enough that I don't care about the difference for the vast majority of my traffic (how many sites do I actually trust more than I trust some rando pretending to be them? Not many, and those few are the only ones where 3rd-party verification gives me any useful information). If we decoupled the need to just encrypt transport (which is easy) from the need to verify authenticity (which is hard), we wouldn't need so many CAs to begin with (because far fewer sites would need them) and stuff falling through the cracks like this would be both less likely and easier to spot.
> How people still think the PKI system is actually delivering security is beyond me.
It has its problems, but it's what we've got to work with right now, and it's not as bad as you make it seem.
> it's identical to a self-signed cert, since Comodo is a known bad actor now
That's not technically true. I dislike Comodo as much as the next person, but this statement is a bit disingenuous, since you're implying that you can trust anyone who generates their own certificate for google.com or yourbank.com more than a CA-signed certificate. There's a reason PKI exists; it's because self-signed certificates by themselves aren't trustworthy in the wild.
But Comodo can issue a certificate for google.com or yourbank.com
They may have, for that matter. Do you check the issuer every time you go to a secure site? Do you trust them to do a better job securing either of those domains than they did with a large telecom in Austria?
And they have to do that precisely because there are 170 or so entities of various levels of dubiousness that are by default authorized to sign any certificate for any domain, and everybody knows that this is fundamentally a horrible idea.
For that matter, since HPKP requires sideband key management, it's
A) an admission that PKI doesn't actually work, and
B) a pretty clear example of why the CAs are unnecessary
If you have pinned certificates you are essentially operating exactly the way 99% of us do with SSH (only rather better because there are several million eyes on high-value certificates), which means you don't need CAs anymore.
Pins are either built into the browser by the vendor, or assigned on first access AFTER a successful server authentication (via the cert).
Pins are trusted/verified through another channel.
SSH Tofu trust occurs pre server authentication. It has no defense against an ALWAYS mitm. Of course there are far less ALWAYS MITM for SSH than TLS.
You have no way of validating the pubkey you have written to known_hosts against anything else.
We have zero idea how many bad certs like this may be out there (the nefarious people won't publish their results, after all), and yet a browser will still treat a Comodo cert as better than a self-signed one (it's identical to a self-signed cert, since Comodo is a known bad actor now). It's better than plaintext, of course, but that's not saying much.