Podcast
Root Causes 440: Public Key Directories


Hosted by
Tim Callan
Chief Compliance Officer
Jason Soroko
Fellow
Original broadcast date
November 18, 2024
We talk about public key directories and complicating factors such as Tailscale, VPN, TOR, Cloudflare, and Zero Trust.
Podcast Transcript
Lightly edited for flow and brevity.
Therefore, if you want to do business together, in a lot of these scenarios that use an asymmetric secret, PKI, ultimately using certificate lifecycle management if you're using certificates, then the beauty of the public key directory - everybody talks about the protection of the private key. That's what gets most of the air play.
Because it's the sexy, the thing the bad guy is going after, the thing you gotta protect, the thing you gotta put into a secure element, the thing you cannot let go out of your hands. But the elegance and the real power of a lot of things is happening because of the fact that you can share those public keys out easily. So there's a few things we're going to cover here, Tim. One is this. Let's talk about things where public keys are not distributed centrally. One of these days, you and I are going to do a podcast on PGP.
How is that magically happening so easily? It's because it all these devices know where to go to pick up the public key of the thing it needs to connect to. That's the real innovation that happened there. But it's all about making public key handouts so dead easy. It's the opposite of PGP in that sense.
So let's talk about some further innovations then. VPN. You and I have talked quite a bit about how you go off and a non-enterprise VPN, so something you're using, typically to an average person who doesn't work in an enterprise, who is using a VPN to go to the coffee shop and encrypt their session within their coffee shop Wi-Fi, hotel Wi-Fi, airport Wi-Fi. So great. What you've done is you're saying, I don't trust anybody on the network of this coffee shop, hotel, airport, but I do trust my VPN provider. Is that always the best idea? The answer is probably no. That's the honest truth. Therefore that form of public key directory-based system might not be, that's an area where I think that we shouldn't deprecate the idea of VPN. I'm not calling for that. But what I am saying is understand who you're trusting.
You and I have had a podcast in the past about doing Tor over VPN or VPN over Tor. And you're really shifting who you're trusting and distrusting, because if you distrust your ISP, or you distrust the Tor exit node, it depends on who you trust and who you distrust, and I think for the average person, they're not able to make that decision. But now let's talk about VPN within the enterprise as a public key, another usage of this grand idea. I think that VPN into the enterprise has a fundamental flaw. It doesn't have to, but pragmatically it does, and that is, nobody uses the principle of least privileges in their networks sufficiently.
In other words, the reason why I brought up Tailscale and certain kinds of equivalents that are using wire guard, like Cloudflare Tunnels, and there's a number of these things that are out there. I'm not going to call them all out. I think that in a modern enterprise using a peer to peer encrypted session based off of an easy to use public key directory beats a VPN where you become a node on an entire enterprise network that has a set of privileges. So, for example, I'll tell you that the nightmare scenario is you have a systems administrator who has a static credential.
So Tim, we're calling this out simply because (a) hallelujah. Innovations and public key distribution are making the world better, and I think it's doing it silently. Once again, PPI being ubiquitous and just forgotten about in the corner. I'm pointing at it, going, check it out. I'm also saying some of your old sacred cows of how you used to log into things, they need to go and die.

