#homoglyphattacks — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #homoglyphattacks, aggregated by home.social.
-
The more I think about this, the more I converge on "short-lived certs and #TOFU don't go well together".
In reality, it would probably have to be "trust on first use, trust again after expiry and just before expiry".
If you have an attacker who can do #MitM in your home network (and without this it doesn't make sense to discuss #TLS at all), all the attacker has to do is wait for the current short-lived cert to expire and then present his/her own cert on the next connection attempt.
Plus (for automatic TOFU, without user confirmation) an attacker with MitM in your home network could do phishing with #HomoglyphAttacks or so (and inject a DNS response as he/she wants).
Revocation is a valid concern, but maybe in the "home network" case you know all devices that will connect to the compromised service and opening the browser settings on all devices to manually revoke trust in the compromised cert is a viable way to (effectively) revoke trust in the cert.
If you wanted to go for "trust on first use after user confirmation", I'd say the UI/UX should be very different from the normal UI/UX for "browser warns you about invalid cert", otherwise all of this would train users to ignore the normal browser warnings about invalid certs.
-
The more I think about this, the more I converge on "short-lived certs and #TOFU don't go well together".
In reality, it would probably have to be "trust on first use, trust again after expiry and just before expiry".
If you have an attacker who can do #MitM in your home network (and without this it doesn't make sense to discuss #TLS at all), all the attacker has to do is wait for the current short-lived cert to expire and then present his/her own cert on the next connection attempt.
Plus (for automatic TOFU, without user confirmation) an attacker with MitM in your home network could do phishing with #HomoglyphAttacks or so (and inject a DNS response as he/she wants).
Revocation is a valid concern, but maybe in the "home network" case you know all devices that will connect to the compromised service and opening the browser settings on all devices to manually revoke trust in the compromised cert is a viable way to (effectively) revoke trust in the cert.
If you wanted to go for "trust on first use after user confirmation", I'd say the UI/UX should be very different from the normal UI/UX for "browser warns you about invalid cert", otherwise all of this would train users to ignore the normal browser warnings about invalid certs.
-
The more I think about this, the more I converge on "short-lived certs and #TOFU don't go well together".
In reality, it would probably have to be "trust on first use, trust again after expiry and just before expiry".
If you have an attacker who can do #MitM in your home network (and without this it doesn't make sense to discuss #TLS at all), all the attacker has to do is wait for the current short-lived cert to expire and then present his/her own cert on the next connection attempt.
Plus (for automatic TOFU, without user confirmation) an attacker with MitM in your home network could do phishing with #HomoglyphAttacks or so (and inject a DNS response as he/she wants).
Revocation is a valid concern, but maybe in the "home network" case you know all devices that will connect to the compromised service and opening the browser settings on all devices to manually revoke trust in the compromised cert is a viable way to (effectively) revoke trust in the cert.
If you wanted to go for "trust on first use after user confirmation", I'd say the UI/UX should be very different from the normal UI/UX for "browser warns you about invalid cert", otherwise all of this would train users to ignore the normal browser warnings about invalid certs.
-
The more I think about this, the more I converge on "short-lived certs and #TOFU don't go well together".
In reality, it would probably have to be "trust on first use, trust again after expiry and just before expiry".
If you have an attacker who can do #MitM in your home network (and without this it doesn't make sense to discuss #TLS at all), all the attacker has to do is wait for the current short-lived cert to expire and then present his/her own cert on the next connection attempt.
Plus (for automatic TOFU, without user confirmation) an attacker with MitM in your home network could do phishing with #HomoglyphAttacks or so (and inject a DNS response as he/she wants).
Revocation is a valid concern, but maybe in the "home network" case you know all devices that will connect to the compromised service and opening the browser settings on all devices to manually revoke trust in the compromised cert is a viable way to (effectively) revoke trust in the cert.
If you wanted to go for "trust on first use after user confirmation", I'd say the UI/UX should be very different from the normal UI/UX for "browser warns you about invalid cert", otherwise all of this would train users to ignore the normal browser warnings about invalid certs.
-
The more I think about this, the more I converge on "trust on first use and #TOFU don't go well together".
In reality, it would probably have to be "trust on first use, trust again after expiry and just before expiry".
If you have an attacker who can do #MitM in your home network (and without this it doesn't make sense to discuss #TLS at all), all the attacker has to do is wait for the current short-lived cert to expire and then present his/her own cert on the next connection attempt.
Plus (for automatic TOFU, without user confirmation) an attacker with MitM in your home network could do phishing with #HomoglyphAttacks or so (and inject a DNS response as he/she wants).
Revocation is a valid concern, but maybe in the "home network" case you know all devices that will connect to the compromised service and opening the browser settings on all devices to manually revoke trust in the compromised cert is a viable way to (effectively) revoke trust in the cert.
If you wanted to go for "trust on first use after user confirmation", I'd say the UI/UX should be very different from the normal UI/UX for "browser warns you about invalid cert", otherwise all of this would train users to ignore the normal browser warnings about invalid certs.