11–20 of 88 posts
Windows 7 was released 5 years ago. Might be more relevant to compare to Windows 10 given that Yosemite is updated quite regularly.
It's a choice that users must do, not the OS. I don't blame computer manufacturers for adding these certs to their systems, they try to make browsing as easy as it gets. Theoretically speaking, the government is your friend. Practically speaking, if you're into any business that requires extra security, you need to take control of your OS at much deeper level, which probably means running something Open Source and manually checking the certificates that came along with your system and your browsers.
This is not news. The CA system is broken by design. It's been this way from the start. Not just on OSX but on all platforms. Your browser blindly trusts a list of a few hundred CA's, any of which can impersonate any SSL site you visit at any time (except for the chosen few that use certificate pinning) Many of the biggest CA's (e.g. Verisign) are under government control.
The browsers could start not trusting those CAs, and not allowing them to impersonate any SSL site you visit, and they are making steps towards this with measures like pinning aren't they?
Measures like that just need to be made the default, and if companies want the ability to MITM they should have to adjust settings to make that happen, but consumers should not be vulnerable to that by default and browser vendors could work towards that future. At least people are now more aware of these issues, and that a green lock really doesn't signify much if a government takes an interest in your communications.
Most of the certs listed in the blog post are in Mozilla's trust store[1] and in Windows trust store[2] as well. [1] https://www.mozilla.org/en-US/about/governance/policies/secu... [2] (PDF) http://download.microsoft.com/download/1/5/7/157B29AB-F890-4...
* ApplicationCA (Japan)
* China Internet Network Information Center EV Certificates Root (China)
From a Ctrl+F of [2], there's:
* ApplicationCA (Japan)
* FPKI Common Policy (US)
* China Internet Network Information Center EV Certificates Root (China)
The only odd one out seems to be DoD Root CA 2.
Why doesn't the browsers collect information from its users (if they agree to it) about which CAs are used by which domains - and display a strong warning if a different CA than the norm tries to issue a certificate?
And to be honest who really cares. Countries increasingly are mandating invasive spying through legislation. Arguing over CAs is like rearranging deckchairs on the titanic.
This is not news. The CA system is broken by design. It's been this way from the start. Not just on OSX but on all platforms. Your browser blindly trusts a list of a few hundred CA's, any of which can impersonate any SSL site you visit at any time (except for the chosen few that use certificate pinning) Many of the biggest CA's (e.g. Verisign) are under government control.
It doesn't have to be this way though. The browsers could start not trusting those CAs, and not allowing them to impersonate any SSL site you visit, and they are making steps towards this with measures like pinning aren't they? Measures like that just need to be made the default, and if companies want the ability to MITM they should have to adjust settings to make that happen, but consumers should not be vulnerable t…
Pinning is an unscalable hack around the core problem.
When scanning through the list of CAs on my machine, so many of them sound like unknown entities who I have no idea whether or not to trust. So it's difficult deciding whether I should remove any of them or not. What would really help in this would be to know if any of these CAs have signed certificates for popular websites. Rightly or wrongly, I'd trust a CA who has certificates in active use by many sites over an o…
Maybe Google's certificate transparency is what you are looking for? http://www.certificate-transparency.org A more practical approach: Disable all root certificates, then enable them one by one as you are getting browser warnings.
However, in any case, there are already so many CAs, that I am wondering what is preventing governments of forcing one of them to provide a fake certificate that suits their needs for national security reasons...
Earlier quoted context omitted.
It doesn't have to be this way though. The browsers could start not trusting those CAs, and not allowing them to impersonate any SSL site you visit, and they are making steps towards this with measures like pinning aren't they? Measures like that just need to be made the default, and if companies want the ability to MITM they should have to adjust settings to make that happen, but consumers should not be vulnerable t…
> and they are making steps towards this with measures like pinning aren't they? Pinning is an unscalable hack around the core problem.
Pull requests welcome, Don't run unless you know what you're doing, YMMV etc....