Home / News

Proposal on How SSL Certificate Industry Should Be Replaced Gains Some Momentum

SSL replacement proposal made by security expert Moxie Marlinspike, last August at the Black Hat Conference (called 'Convergence'), is gaining some momentum, particularly after the recent hacker attacks on DigiNotar, GlobalSign, Comodo and other SSL certificate authorities that have resulted in fake certificates coming into use on the web, including a fake Google certificate, since revoked. Marlinspike thinks this whole system — which props up the multi-million-dollar certificate authority business today — should be dumped in favor of the idea of the user more directly controlling how the browser trusts certificates based on so-called Convergence "notaries" proving online feedback about what to trust.

Read full story: Network World

Related topics: Cyberattack, Cybercrime, Security

 
   
WEEKLY WRAP — Get CircleID's Weekly Summary Report by Email:

Comments

Two things David A. Ulevitch  –  Oct 12, 2011 11:48 AM PDT

This has been in the works for a LONG time, and discussed for a while.  SSL has always been a sham.  Momentum had been quietly building for a while, and it just took a few CAs to bring it into the mainstream light.  The idea of embedding SSL fingerprints in DNS has been discussed for years, for instance.

So my two thoughts:
1) This is definitely going to happen.  Chrome will be pushing it the Google way, and Moxie (and many others) will push it the other ways.  Both will probably gain traction.
2) This makes Verisign look very smart for selling off the SSL business to Symantec.  And makes Symantec look like the goofballs they usually are.  Their absolute lack of real security vision is second to none.

IETF DANE Paul Vixie  –  Oct 13, 2011 7:10 AM PDT

The certificate authority system used by the web's e-commerce system is indeed weak.  What's less certain is that it ought to be replaced by multiple approaches, one from Moxie, one from Google, and so on.

The Internet Engineering Task Force (IETF) has a DNS-based Authentication of Named Entities (DANE) working group and is a dozen revisions into a DNSSEC profile for authenticating the certificates needed for e-commerce.

This protocol will work, it will be as secure as DNSSEC itself, and it will scale.  I urge the technical and business communities to get behind a single global standard to replace the X.509 certificate authority system.

To post comments, please login or create an account.

Related Blogs

Related News

Explore Topics

Industry Updates – Sponsored Posts

Verisign Q1 2016 DDoS Trends: Attack Activity Increases 111 Percent Year Over Year

Is Your TLD Threat Mitigation Strategy up to Scratch?

i2Coalition to Host First Ever Smarter Internet Forum

Encrypting Inbound and Outbound Email Connections with PowerMTA

Resilient Cybersecurity: Dealing with On-Premise, Cloud-Based and Hybrid Security Complexities

Verisign Releases Q4 2015 DDoS Trends - DDoS Attack Activity Increasing by 85% Year Over Year

Best Practices from Verizon - Proactively Mitigating Emerging Fraudulent Activities

Neustar Data Identifies Most Popular Times of Year for DDoS Attacks in 2015

The Framework for Resilient Cybersecurity (Webinar)

2015 Trends: Multi-channel, Streaming Media and the Growth of Fraud

Data Volumes and Network Stress to Be Top IoT Concerns

DKIM for ESPs: The Struggle of Living Up to the Ideal

Verisign Mitigates More Attack Activity in Q3 2015 Than Any Other Quarter During Last Two Years

Verisign & Forrester Webinar: Defending Against Cyber Threats in Complex Hybrid-Cloud Environments

Introducing Verisign Public DNS: A Free Recursive DNS Service That Respects Your Privacy

Faster DDoS Mitigation - Introducing Verisign OpenHybrid Customer Activated Mitigation

Verisign's Q2'15 DDoS Trends: DDoS for Bitcoin Increasingly Targets Financial Industry

Protect Your Network From BYOD Malware Threats With The Verisign DNS Firewall

Announcing Verisign IntelGraph: Unprecedented Context for Cybersecurity Intelligence

The Deep Web and the Darknet - The Nether Regions of the Internet

Sponsored Topics

Afilias

DNS Security

Sponsored by
Afilias
Afilias - Mobile & Web Services

Mobile

Sponsored by
Afilias - Mobile & Web Services
Port25

Email

Sponsored by
Port25
Verisign

Security

Sponsored by
Verisign