Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

Post by [deleted] » Fri, Feb 20, 2015, 4:37 AM UTC

lazyjones wrote: post #52

schoen wrote: post #16

Earlier quoted context omitted.

Maybe it triggers the logic that allows (supposedly) user-added certs to override those pins? (Google was pressured into adding such logic by corporate users, whose IT departments want to -- supposedly openly -- MITM employees' connections.) Edit: I think that's the case. AGL's original announcement of pinning said: "There are a number of cases where HTTPS connections are intercepted by using local, ephemeral certifi…

> Google was pressured into adding such logic by corporate users, whose IT departments want to -- supposedly openly -- MITM employees' connections "openly"? Why doesn't the user see that a fake certificate is being used then? There is no excuse for not showing a big fat warning. This only shows which side Google is really on when it's evil corporations vs. you, the user.

Post by [deleted] » Fri, Feb 20, 2015, 4:39 AM UTC

lstamour wrote: post #46

hurin wrote: post #12

Earlier quoted context omitted.

I'm somewhat puzzled by the single certificate. Couldn't they have generated a new signing request and self-signed on each machine - at least ensuring that each customer has a unique cert for their proxy?

These guys aren't the brightest bulbs out there. You could even have it switch certificates on every reboot... or not do this in the first place. ;-)

Post by [deleted] » Fri, Feb 20, 2015, 4:40 AM UTC

userbinator wrote: post #40

While this whole Superfish/Lenovo thing is certainly quite scary, let's not forget the very important fact that, currently, the user ultimately still has the ability to modify the software on the machines he/she owns, which includes among other things (un)installing software like Superfish, and also adding/removing trusted certificates. There will be those who advocate locking down the certificate stores and other ar…

Post by yuhong » Fri, Feb 20, 2015, 4:48 AM UTC

gluxon wrote: post #66

tveita wrote: post #4

This is a PDF attached to this issue, requesting blacklisting of the Superfish certificate: https://bugzilla.mozilla.org/show_bug.cgi?id=1134506

From what I understand of Superfish, Mozilla (and other browser vendors) can't just blacklist the certificate. That would make all HTTPS connections error out. A message notifying users of the issue is all they can do.

Post by NegativeK » Fri, Feb 20, 2015, 5:10 AM UTC

enneff wrote: post #58

sitkack wrote: post #29

Earlier quoted context omitted.

TIL Google is ok if you get backdoored by your boss.

If your boss owns the tools with which you do your work, they have the right to dictate how you use them. Use personal devices for personal computing.