Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

bug1134506.bugzilla.mozilla.org

Post reply on HN
Print view View original

51–60 of 188 posts

Re: Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

#51

Post by mynameisvlad »

thought_alarm wrote: post #47
userbinator wrote: post #40

While this whole Superfish/Lenovo thing is certainly quite scary, let's not forget the very important fact that, currently, the user ultimately still has the ability to modify the software on the machines he/she owns, which includes among other things (un)installing software like Superfish, and also adding/removing trusted certificates. There will be those who advocate locking down the certificate stores and other ar…

You're an idiot.

Way to completely disregard the rest of the parent's comment, which makes a fantastic point, and instead blindly call him an idiot.

Re: Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

#52

Post by lazyjones »

schoen wrote: post #16
edohyiez wrote: post #14

I find it a bit weird that it can MITM https://www.google.com/ on Chrome. I thought Chrome did CA-pinning for Google-domains.

Maybe it triggers the logic that allows (supposedly) user-added certs to override those pins? (Google was pressured into adding such logic by corporate users, whose IT departments want to -- supposedly openly -- MITM employees' connections.) Edit: I think that's the case. AGL's original announcement of pinning said: "There are a number of cases where HTTPS connections are intercepted by using local, ephemeral certifi…

> Google was pressured into adding such logic by corporate users, whose IT departments want to -- supposedly openly -- MITM employees' connections

"openly"? Why doesn't the user see that a fake certificate is being used then? There is no excuse for not showing a big fat warning.

This only shows which side Google is really on when it's evil corporations vs. you, the user.

Re: Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

#53

Post by patcheudor »

userbinator wrote: post #48
ryan-c wrote: post #45

Earlier quoted context omitted.

...is it blindly copying any x509v3 attributes present on the certificate, or just the one that you seem to be carefully not mentioning? Can you email me (one is listed in my HN profile)? I just thought of a pretty horrible exploit. 2199399413f2e63e6291a3f3e60f3475518aaf88215434222c65d6bc6fe41f34

After a little more thought, it seems obvious to me now what the problem is. :-) The shocking thing is that the certificate name matching algorithm has been standardised for over 15 years and yet those who wrote the cert generation code weren't aware of how browsers implement it.

Ding, ding, ding. ;-)

Re: Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

#54

Post by MichaelGG »

kinofcain wrote: post #22
semenko wrote: post #17

Earlier quoted context omitted.

Chrome does do pinning, but ignores pins when the cert parent is a privately installed cert (because this is a "feature" used by many enterprises). """ Chrome does not perform pin validation when the certificate chain chains up to a private trust anchor. A key result of this policy is that private trust anchors can be used to proxy (or MITM) connections, even to pinned sites. 'Data loss prevention' appliances, firewa…

And the rationale: "We deem this acceptable because the proxy or MITM can only be effective if the client machine has already been configured to trust the proxy’s issuing certificate" I think that's fair, or at least it has traditionally been a fair assumption for most users. The issue here is that your hardware vendor has compromised your machine, so that is no longer a fair assumption.

Well continue the process. Suppose Chrome did flag such things. That'd break a lot of "legitimate" use cases, and someone would implement a workaround. For instance, they could just patch the Chrome binaries to disable the warnings or change the pinning logic. Insert their own certs into the pin list. Without something like Intel SGX, you or Google can't totally win.

Of course, Chrome could give some indication like a lock+eyeball or something, and hope the interception vendors are too lazy to bother modifying the code. They could also only disable warnings if the machine is connected to a domain or other management system.

Re: Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

#57

Post by emehrkay »

Computing is genuinely becoming scary. If I didn't browse tech sites or spend my days on HackerNews, I probably wouldn't know about these things. I'm getting older and more disinterested in the constant maintenance -- I just want the shit to work. It sucks the most for those who learned "don't install anything fishy, run a virus scan, don't open attachments, and you'll be fine." They bought a computer and followed the rules and are still being fucked over. I've seen a high number of comments that say "oh man, I never trust OEM software, clean installs only for me." So it looks like there is another rule for the pleb/peasant/uninitiated computer users to follow. I can barely keep up, I wonder how nontechnical people do.

Re: Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

#58

Post by enneff »

sitkack wrote: post #29
semenko wrote: post #17

Earlier quoted context omitted.

Chrome does do pinning, but ignores pins when the cert parent is a privately installed cert (because this is a "feature" used by many enterprises). """ Chrome does not perform pin validation when the certificate chain chains up to a private trust anchor. A key result of this policy is that private trust anchors can be used to proxy (or MITM) connections, even to pinned sites. 'Data loss prevention' appliances, firewa…

TIL Google is ok if you get backdoored by your boss.

If your boss owns the tools with which you do your work, they have the right to dictate how you use them.

Use personal devices for personal computing.

Post reply on HN