Earlier quoted context omitted.
https://notary.icsi.berkeley.edu/
>Last updated: Thursday, 26. July 2018 03:21 PDT
Shucks, all the good tooling dies young.
Bug 1758773: MITM in Russia
11–18 of 18 posts
Re: Bug 1758773: MITM in Russia
#12How is this a bug in Mozilla? This seems to be about some email the Russian government has sent, and CA certificates. If the certificate is being misused, I think it should be revoked by the authority who approved it.
This is a root ca that can issue as many unauthorized certs as they wish. It is critical that this thing is added to every other explicitly untrusted list in all OSes and Browsers, to protect millions of innocent internet users.
Re: Bug 1758773: MITM in Russia
#13what's the bug? that Mozilla should ban this certificate so the West can successfully disrupt Russia's internet?
No, so the Russian government cannot intercept every https (TLS) connection out of the country. With this they could attack every user on ruNET and capture every password, every email, every message… it is critical that it be blocked for the safety of the internet.
Re: Bug 1758773: MITM in Russia
#14I hate to say it, but here it is: that's a feature not a bug.
Don't tell them. They still believe that if they use TLS and some {google, microsoft, cloudfare, etc} cert they are safe.
Re: Bug 1758773: MITM in Russia
#15what's the bug? that Mozilla should ban this certificate so the West can successfully disrupt Russia's internet?
No, so the Russian government cannot intercept every https (TLS) connection out of the country. With this they could attack every user on ruNET and capture every password, every email, every message… it is critical that it be blocked for the safety of the internet.
Centralized trust is the mechanism used by the current version of the web. It is a broken system by design. Who says I can trust verisign or any other CA. Russia creating their own CA and asking it to be installed just emphasize how broken the current mechanisms are. Its not new, its always been broken.
Re: Bug 1758773: MITM in Russia
#16Earlier quoted context omitted.
No, so the Russian government cannot intercept every https (TLS) connection out of the country. With this they could attack every user on ruNET and capture every password, every email, every message… it is critical that it be blocked for the safety of the internet.
Centralized trust is the mechanism used by the current version of the web. It is a broken system by design. Who says I can trust verisign or any other CA. Russia creating their own CA and asking it to be installed just emphasize how broken the current mechanisms are. Its not new, its always been broken.
It’s a lot more complex than you may realize. We have a transparency solution known as Certificate Transparency. For a “verisign” issued cert to be trusted in the browser, there must be an append only record of the cert stored in a blockchain. If Russia overrides a local trusted root, all bets are off an CTlog is not used. You can trust the CA because malicious issuance is a death sentence. And we have logs for all eternity.
Re: Bug 1758773: MITM in Russia
#17Earlier quoted context omitted.
Centralized trust is the mechanism used by the current version of the web. It is a broken system by design. Who says I can trust verisign or any other CA. Russia creating their own CA and asking it to be installed just emphasize how broken the current mechanisms are. Its not new, its always been broken.
It’s a lot more complex than you may realize. We have a transparency solution known as Certificate Transparency. For a “verisign” issued cert to be trusted in the browser, there must be an append only record of the cert stored in a blockchain. If Russia overrides a local trusted root, all bets are off an CTlog is not used. You can trust the CA because malicious issuance is a death sentence. And we have logs for all e…
Hmm I had never heard of Certificate Transparency, looks like its a relatively newish tech added onto how SSL/TLS certs work. It seems only Google Chrome & Safari require SCT chains (not used by Firefox). Maybe I've never heard of it because I'm a Firefox user? You mentioned blockchain, does that mean there is a public blockchain for these Certs? I didn't see that mentioned anywhere but it does seem like blockchain features overlap with the desired features of "Certificate Transparency".
Re: Bug 1758773: MITM in Russia
#18Earlier quoted context omitted.
It’s a lot more complex than you may realize. We have a transparency solution known as Certificate Transparency. For a “verisign” issued cert to be trusted in the browser, there must be an append only record of the cert stored in a blockchain. If Russia overrides a local trusted root, all bets are off an CTlog is not used. You can trust the CA because malicious issuance is a death sentence. And we have logs for all e…
Hmm I had never heard of Certificate Transparency, looks like its a relatively newish tech added onto how SSL/TLS certs work. It seems only Google Chrome & Safari require SCT chains (not used by Firefox). Maybe I've never heard of it because I'm a Firefox user? You mentioned blockchain, does that mean there is a public blockchain for these Certs? I didn't see that mentioned anywhere but it does seem like blockchain f…
There is a blockchain ran by a bunch of interested third parties for CT, yes.
The block chain is different for each CT operator, it just allows you to validate the issued certs.