We live in the age of technology. It is a fast-paced, break-neck ride to deliver great solutions—everything from the largest, complex integrated solution to the single, simple iPhone app. With online solutions a part of so much of our everyday lives, why are we still talking about digital certificates, the backbone of internet communication, being broken?
I will tell you why. It’s hard. Once Netscape introduced the SSL protocol used with x.509 certificates in 1994, it was obvious we needed to fix online communication and FAST. We seized the quickest solution and the use of x.509 certificates with SSL for online communications soared. With this protection, online commerce exploded with the confidence that identity and privacy could be ensured.
Well, the internet is all “grow’d up” and our SSL/TLS solution needs to be refitted. Moxie Marlinspike at Defcon 19 in 2011 told an over-packed audience of hackers at the Rio in Las Vegas that the way we establish trust needs to change; we need to take the power back from trust stores that have been force-fed into our systems and make our own intelligible decision on who or what we want to trust. Convergence Beta was then created.
I just got back from Defcon 23 and, yet again, there were several talks on exploiting digital certificate weaknesses. Besides the few sneaky hacks I saw, it was interesting to see a solution proposed to the open source community to try and help our broken trust. A couple of guys, for the love of protected communications, came up with a product called TLS Canary (warning: the content is provocative). In real time, it will check the trustworthiness of the certificate you are trying to access and tell you whether it is good or bad.
There are now several approaches to certificate trustworthiness, but we need to ensure that we’re turning to a comprehensive source. Google is running the Google CT (Certificate Transparency) project, TLS Canary has been developed, and we have the SSL Observatory. In addition, some people are trying to solve issues with certificate pinning. Good, great! Finally we have several groups out there pushing for and delivering solutions. Everyone is starting to see the issue that Venafi has been solving for years. Venafi provides the single most comprehensive source of certificate trustworthiness.
Venafi has a platform that will bring order to the chaos that is your PKI (Public Key Infrastructure) and keys though the Trust Protection Platform. Technology overall has been slow to address its trust issues, and understandably, because it’s hard. But let’s heal our known broken trust issues already so we can get new, interesting topics at Defcon!