Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Symantec Issues Intermediate CA Certificate for Blue Coat Public Services

crt.sh

Post reply on HN
Print view View original

111–118 of 118 posts

Re: Symantec Issues Intermediate CA Certificate for Blue Coat Public Services

#111

Post by mikecb »

kerkeslager wrote: post #110
mikecb wrote: post #93

Earlier quoted context omitted.

Seems like it would have unacceptable performance limitations.

That's your source of security? Performance limitations? I'm not even convinced it would have performance limitations. Let's say Alice and Bob are communicating and Eve has the BlueCoat device in the middle. Alice sends the initial connection request to Bob, but Eve gets it instead. Eve then sends a new initial request to Bob AND a request to the BlueCoat server to get the fake cert in parallel . As long as the BlueC…

I didn't say that at all.

Re: Symantec Issues Intermediate CA Certificate for Blue Coat Public Services

#112

Post by throwaway2048 »

maulwuff wrote: post #91
prdonahue wrote: post #78

Earlier quoted context omitted.

> today's browsers use certificate pinning, i.e. Chrome, Firefox... have predefined lists of sites where they know which public key to expect. One example of such a site is google.com. Yes, this may be true, but the list is quite small. You may not be able to trick Chrome into connecting to a fake google.com certificate but there's lots other "high security site[s]" as Adam Langley suggests[1] should apply when they…

While the list is definitely incomplete I would not call it small. Have a look at https://chromium.googlesource.com/chromium/src/net/+/master/...

its easy to discover whats on the list by people doing mitm...

Re: Symantec Issues Intermediate CA Certificate for Blue Coat Public Services

#113

Post by kerkeslager »

mikecb wrote: post #111
kerkeslager wrote: post #110

Earlier quoted context omitted.

That's your source of security? Performance limitations? I'm not even convinced it would have performance limitations. Let's say Alice and Bob are communicating and Eve has the BlueCoat device in the middle. Alice sends the initial connection request to Bob, but Eve gets it instead. Eve then sends a new initial request to Bob AND a request to the BlueCoat server to get the fake cert in parallel . As long as the BlueC…

I didn't say that at all.

Okay, so what did you mean when you said, "Seems like it would have unacceptable performance limitations."

Re: Symantec Issues Intermediate CA Certificate for Blue Coat Public Services

#114

Post by dsl »

prdonahue wrote: post #57
AaronFriel wrote: post #33

Earlier quoted context omitted.

Even Cloudflare doesn't use their own CA, but they have a relationship with Comodo; at least, from what I can tell on services I use with Cloudflare. If they just need to issue lots of certificates, or make it easy for client devices to get certificates, or even for their own cloud services, they could use LetsEncrypt. There are very few use cases where having your own CA is necessary, and for a company like Blue Coa…

We have relationships with Comodo, DigiCert, and GlobalSign. A large part of our Universal SSL issuance is currently through Comodo, which is probably what you noticed. (We've considered acquiring our own CA or subCA in the past but the audit requirements are quite onerous, at least after the first year, and sometimes it's nice to have someone handle certain aspects for you.) The most important thing to pay attention…

Thank you. Given that CloudFlare is basically replacing the public internet one site at a time, I feel better that there is at least some third party accountability on your power.

Re: Symantec Issues Intermediate CA Certificate for Blue Coat Public Services

#115

Post by iancarroll »

marianov wrote: post #96
prdonahue wrote: post #57

Earlier quoted context omitted.

We have relationships with Comodo, DigiCert, and GlobalSign. A large part of our Universal SSL issuance is currently through Comodo, which is probably what you noticed. (We've considered acquiring our own CA or subCA in the past but the audit requirements are quite onerous, at least after the first year, and sometimes it's nice to have someone handle certain aspects for you.) The most important thing to pay attention…

How onerous ? I would like the CA I work for to be included in the trusted list.

You work for a CA that isn't audited or trusted?

Re: Symantec Issues Intermediate CA Certificate for Blue Coat Public Services

#116

Post by bigiain »

Spooky23 wrote: post #109
danielweber wrote: post #106

Earlier quoted context omitted.

I agree that people running the network have the right to run it as they want. But if an attack can work on you using my network, it is also an attack that works on me surreptitiously rerouting your traffic onto my network. Basically undoing HTTPS.

The scope is broader than an attack. Also, what I'm talking about (MITM proxy on a private network), it's not sneaky -- you will get unsigned cert warnings. If you are using an employers device, you won't see warnings, but can examine the SSL certificate. You should also assume that you are being monitored.

"you will get unsigned cert warnings"

No you wont. Bluecoat now has a CA Cert root key signed by Symantec. If they issue a .google.com or .gmail.com ssl cert you will _not_ get an unsigned cert warning.

And explain to me how to connect to, say, my internet banking without using "a private network"? Every single hop between my house(or my phone) and my bank is a piece of network owned by some company or other. "Use your own network" is meaningless in the context of connecting to any hardware you don't own yourself.

Re: Symantec Issues Intermediate CA Certificate for Blue Coat Public Services

#117

Post by bigiain »

Spooky23 wrote: post #100
Dylan16807 wrote: post #74

Earlier quoted context omitted.

Do you see no value in SSL at all, then?

As a private network owner, I see risk in uncontrolled SSL. If you provide a publicly accessible "Guest" network isolated from my corporate or private resources, that I agree that it's unreasonable to intercept TLS sessions. If you are on my network, which exists to serve my constituents with a personal device, I have every right to or even have a duty to ensure that you aren't threatening the overall integrity of th…

And what do I do when you get a job at my cellular provider, and decide that my internet banking or healthcare website connections might be me "exfiltrating data" and you choose to take it upon yourself to inspect the contents of those connections just in case I'm somehow "threatening the overall integrity of the cellular provider's network"?

Re: Symantec Issues Intermediate CA Certificate for Blue Coat Public Services

#118

Post by prdonahue »

iancarroll wrote: post #115
marianov wrote: post #96

Earlier quoted context omitted.

How onerous ? I would like the CA I work for to be included in the trusted list.

You work for a CA that isn't audited or trusted?

$ sudo yum install -y ca && /usr/bin/whoami

youworkforacertificateauthority

Post reply on HN