Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

bug1134506.bugzilla.mozilla.org

Post reply on HN
Print view View original

71–80 of 188 posts

Re: Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

#71

Post by hellbanner »

ryan-c wrote: post #45
patcheudor wrote: post #32

Earlier quoted context omitted.

You're close. I'm not in the business of telling people how to exploit this and am assuming those who already know were already doing it based on what would be a "best practice" (for a bad guy that is) when it comes to generating a self-signed cert.

...is it blindly copying any x509v3 attributes present on the certificate, or just the one that you seem to be carefully not mentioning? Can you email me (one is listed in my HN profile)? I just thought of a pretty horrible exploit. 2199399413f2e63e6291a3f3e60f3475518aaf88215434222c65d6bc6fe41f34

I'm really just curious & not malicious - is that string at the end of your post a hash of a key or of an exploit code?

Re: Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

#72

Post by dang »

mynameisvlad wrote: post #51
thought_alarm wrote: post #47

Earlier quoted context omitted.

You're an idiot.

Way to completely disregard the rest of the parent's comment, which makes a fantastic point, and instead blindly call him an idiot.

You're right. Still, it would be better to just say nothing, so as not to dilute the thread further. The right tool here is flagging. You can flag an inappropriate comment by clicking on its timestamp to go to its page, then clicking on "flag".

Fortunately, enough other users did so that the comment was killed.

Re: Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

#73

Post by enneff »

NegativeK wrote: post #69
enneff wrote: post #58

Earlier quoted context omitted.

If your boss owns the tools with which you do your work, they have the right to dictate how you use them. Use personal devices for personal computing.

Perhaps a legal right. The line between what computing should be done on what device is blurry in both directions -- it's not just "people do personal computing on corporate devices". It'd be a bit strange to hear a boss tell me to never browse Amazon or Hacker News during lunch.

I think it's wise to assume corporate-owned devices are just that: 0wned by corporations.

I use my work laptop all the time for a variety of things, but I do so under the assumption that the company may be snooping on me. (No idea if they are or not.)

Re: Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

#74

Post by vpeters25 »

skuhn wrote: post #50
vpeters25 wrote: post #37

Earlier quoted context omitted.

The company I work for has a strict policy of no direct outbound connections from the corporate network. This is to prevent (or just make harder) for compromised machines from "phoning home". This has the unfortunate side effect that all internet traffic must go through a proxy, they have to MiTM SSL traffic. I just use my smartphone's data for any personal internet browsing.

Well you don't have to MITM SSL in order to proxy it, it can be done in other ways. They probably choose to do so in order to see the details of the request.

Correct, the firewall intercepts all traffic looking for potential compromises and blocks it. Given all these corporations getting hacked, such measures seem necessary.

Re: Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

#75

Post by Dylan16807 »

vpeters25 wrote: post #37
sitkack wrote: post #29

Earlier quoted context omitted.

TIL Google is ok if you get backdoored by your boss.

The company I work for has a strict policy of no direct outbound connections from the corporate network. This is to prevent (or just make harder) for compromised machines from "phoning home". This has the unfortunate side effect that all internet traffic must go through a proxy, they have to MiTM SSL traffic. I just use my smartphone's data for any personal internet browsing.

I wouldn't say that's a side effect. The point of the policy is to allow the observation of website traffic to make sure it's normal.

Re: Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

#76

Post by userbinator »

emehrkay wrote: post #57

Computing is genuinely becoming scary. If I didn't browse tech sites or spend my days on HackerNews, I probably wouldn't know about these things. I'm getting older and more disinterested in the constant maintenance -- I just want the shit to work. It sucks the most for those who learned "don't install anything fishy, run a virus scan, don't open attachments, and you'll be fine." They bought a computer and followed th…

I've convinced many people to do clean installs on new computers - my reasoning usually goes like "the software it comes with is suitable for demos in the store; when you start using it, you should clean that out and install your own."

It used to be relatively easy to do a full reformat+install of the OS and drivers; not sure whether that's gotten easier or harder now.

Re: Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

#78

Post by Dylan16807 »

sitkack wrote: post #29
semenko wrote: post #17

Earlier quoted context omitted.

Chrome does do pinning, but ignores pins when the cert parent is a privately installed cert (because this is a "feature" used by many enterprises). """ Chrome does not perform pin validation when the certificate chain chains up to a private trust anchor. A key result of this policy is that private trust anchors can be used to proxy (or MITM) connections, even to pinned sites. 'Data loss prevention' appliances, firewa…

TIL Google is ok if you get backdoored by your boss.

I wonder why people are downvoting you. It's a good point and not something everyone has explicitly considered before.

Re: Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

#79

Post by beagle3 »

gluxon wrote: post #66
tveita wrote: post #4

This is a PDF attached to this issue, requesting blacklisting of the Superfish certificate: https://bugzilla.mozilla.org/show_bug.cgi?id=1134506

From what I understand of Superfish, Mozilla (and other browser vendors) can't just blacklist the certificate. That would make all HTTPS connections error out. A message notifying users of the issue is all they can do.

They definitely can blacklist the certificate.

They have the choice of having HTTPS effectively useless (by leaving the certificate there), or making HTTPS not work (by removing it, thus prompting action from the user to fix it -- perhaps by calling their tech savvy nephew).

Browser vendors should (and usually do) err on the side of security.

Re: Browser Vulnerability to Superfish: A Fact-Finding Trip to Best Buy [pdf]

#80

Post by beagle3 »

lazyjones wrote: post #52
schoen wrote: post #16

Earlier quoted context omitted.

Maybe it triggers the logic that allows (supposedly) user-added certs to override those pins? (Google was pressured into adding such logic by corporate users, whose IT departments want to -- supposedly openly -- MITM employees' connections.) Edit: I think that's the case. AGL's original announcement of pinning said: "There are a number of cases where HTTPS connections are intercepted by using local, ephemeral certifi…

> Google was pressured into adding such logic by corporate users, whose IT departments want to -- supposedly openly -- MITM employees' connections "openly"? Why doesn't the user see that a fake certificate is being used then? There is no excuse for not showing a big fat warning. This only shows which side Google is really on when it's evil corporations vs. you, the user.

"openly" usually means "it was burried in a paragraph on page 25 of the 3rd addendum of their employment agreement".
Post reply on HN