Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Github SSL replaced by self-signed certificate in China

news.ycombinator.com

Post reply on HN
Print view View original

71–78 of 78 posts

Re: Github SSL replaced by self-signed certificate in China

#71

Post by songgao »

khuey wrote: post #47
songgao wrote: post #5

This reminds me the Firefox certificate "bug"[1] two years ago. A China certificate root server was added into trusted servers in Firefox and Chinese hackers started to submit bug report regarding this, since people don't trust certificate servers run by China government. Man-in-the-middle attack was exact what Chinese hackers worried about. If they put this fake certificate in a certificate root server that's in the…

If CNNIC is complicit in a MITM attack there will be a paper trail (namely a certificate signed by them) proving their involvement. To this day nobody has produced a cert signed by CNNIC that was used for a MITM attack. There's no reason to believe that CNNIC is bad/evil/whatever other than their affiliation with the PRC. Disclosure: I work for Mozilla, but not on security.

Thanks for the reply. Glad to see some guy from Mozilla here!

You are right there's no reason to believe that CNNIC has to be bad/evil/whatever, but we cannot assume CNNIC would never be bad/evil either. We have to look at its history, and what's behind it.

When something turns bad, it won't throw out an announcement beforehand. And we need something that can handle this in time.

I'm thinking about something like this: in addition to the trusted root server list, keep another list, e.g., less trusted root servers; besides normal update program, put a special piece of code in the browser that allows firefox team to delete certain root server from less trusted root servers on the air. By "on the air", I mean not needing a full version update, or restarting the browser. It can warn the user, but it should not be possible to canceled the deletion.

Re: Github SSL replaced by self-signed certificate in China

#73

Post by X-Istence »

btilly wrote: post #68
jacquesm wrote: post #46

What bugs me about stuff like this is that there will always be mercenaries, guys just like you and me that will do anything as long as it pays. The Chinese government wouldn't stand a chance if they had to do this stuff themselves. Mercenary coders are nothing new, we have them in every country (and sysadmins, companies and so on). But you have to wonder what goes on in their heads, what mindset would prompt you to…

We should be worried about mercenaries when it comes to malware, Russian botnets, and the like. In the case of the Chinese government, I believe the bigger problem is patriots. They honestly believe that they are doing the Right Thing. So did the people who wrote Stuxnet.

Just to be clear, Stuxnet is claimed to have been written by the US government/Israeli Government, not by the Chinese.

Re: Github SSL replaced by self-signed certificate in China

#74

Post by btilly »

X-Istence wrote: post #73
btilly wrote: post #68

Earlier quoted context omitted.

We should be worried about mercenaries when it comes to malware, Russian botnets, and the like. In the case of the Chinese government, I believe the bigger problem is patriots. They honestly believe that they are doing the Right Thing. So did the people who wrote Stuxnet.

Just to be clear, Stuxnet is claimed to have been written by the US government/Israeli Government, not by the Chinese.

Yes.

And my claim is that it was likely written by people who consider themselves patriots, not mercenaries.

Re: Github SSL replaced by self-signed certificate in China

#75

Post by freewizard »

seanmcdirmid wrote: post #61
shimon_e wrote: post #50

In China now. Ping to github is 280ms. The cert I receive is valid. So either they stepped up the game or it isn't universal.

Even the Chinese gov does A/B testing.

It's more likely capacity limit than A/B testing. Returning arbitrary response is consuming more resource compared to cutting off connection (sending TCP RST).

Re: Github SSL replaced by self-signed certificate in China

#76

Post by X-Istence »

qschneier wrote: post #52

FYI there is a petition on whitehouse.gov to deny those people who work on GFW entry US. https://petitions.whitehouse.gov/petition/people-who-help-in...

We should deny all those companies that have developed tools of censorship access to government contracts and deny them the right to work in the United States ... oops, there goes almost every single major networking manufacturer!

Cisco: http://newsandinsight.thomsonreuters.com/California/News/201...

Juniper also implicated: http://www.cfr.org/china/us-internet-providers-great-firewal...

Blue coat: http://online.wsj.com/article/SB1000142405297020368750457700...

Websense: http://opennet.net/west-censoring-east-the-use-western-techn...

The list goes on ...

Re: Github SSL replaced by self-signed certificate in China

#77

Post by khuey »

songgao wrote: post #71
khuey wrote: post #47

Earlier quoted context omitted.

If CNNIC is complicit in a MITM attack there will be a paper trail (namely a certificate signed by them) proving their involvement. To this day nobody has produced a cert signed by CNNIC that was used for a MITM attack. There's no reason to believe that CNNIC is bad/evil/whatever other than their affiliation with the PRC. Disclosure: I work for Mozilla, but not on security.

Thanks for the reply. Glad to see some guy from Mozilla here! You are right there's no reason to believe that CNNIC has to be bad/evil/whatever, but we cannot assume CNNIC would never be bad/evil either. We have to look at its history, and what's behind it. When something turns bad, it won't throw out an announcement beforehand. And we need something that can handle this in time. I'm thinking about something like thi…

That's something that we've considered doing. I'm not sure what the current state is. I suspect there's a bug somewhere on bugzilla.mozilla.org for implementing a cert blocklist that does not require a full update.
Post reply on HN