Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Government-Linked Certificate Authorities in OS X

zitseng.com

Post reply on HN
Print view View original

31–40 of 88 posts

Re: Government-Linked Certificate Authorities in OS X

#31

Post by joosters »

dletozeun wrote: post #18
jakobegger wrote: post #9

Earlier quoted context omitted.

Maybe Google's certificate transparency is what you are looking for? http://www.certificate-transparency.org A more practical approach: Disable all root certificates, then enable them one by one as you are getting browser warnings.

Thank you, I was looking for this. However, in any case, there are already so many CAs, that I am wondering what is preventing governments of forcing one of them to provide a fake certificate that suits their needs for national security reasons...

There's not much to protect against that. But looking for 'perfect' CA protection is hopeless. At least by eliminating the more untrustworthy CAs you can protect against some attacks.

Re: Government-Linked Certificate Authorities in OS X

#32

Post by mrmondo »

JoachimS wrote: post #6

The OSX trusted root can be viewed with the Keychain Access tool. I've removed a lot of CAs I don't trust. There is also (at least one) a project that tracks changes in trust stores in OS:es, Java, browsers: https://github.com/kirei/catt (I am one of the authors.)

Yeah - total band-aid fix for a broken system (CA) but here's how to remove them for anyone interested: https://github.com/sammcj/delete-unknown-root-ca

Re: Government-Linked Certificate Authorities in OS X

#33

Post by Tepix »

With certificate pinning, the chances that malicious use of certificates by rogue CAs goes undetected have decreased a lot.

For Firefox, use CertPatrol:

• http://patrol.psyced.org/

• https://addons.mozilla.org/en-US/firefox/addon/certificate-p...

Also, a few websites are starting to use DNSSEC with TLSA and DANE. There's also a Firefox plugin for that at https://www.dnssec-validator.cz/

Re: Government-Linked Certificate Authorities in OS X

#35

Post by lawl »

bsaul wrote: post #22

I could see another weaker but immediately implementable approach to just issueing a list of domain-root certificate maps that someone would have to manage : Why couldn't browser issue a warning whenever the root CA for a known domain has changed compared to previous browsing sessions ? I suppose MITM attack are targeted and probably depends on the network you're using. If there's a difference between the root certif…

If you use firefox, take a look at https://addons.mozilla.org/de/firefox/addon/certificate-patr...

Does exactly that.

Re: Government-Linked Certificate Authorities in OS X

#36

Post by TazeTSchnitzel »

hsivonen wrote: post #28
threeseed wrote: post #11

> Sidenote: A Windows 7 PC has 38 Certificate Authority certificates installed. My Mac OS X Yosemite has 217 Certificate Authority certificates installed. Windows 7 was released 5 years ago. Might be more relevant to compare to Windows 10 given that Yosemite is updated quite regularly.

Doesn't Windows 7 download root certs from Microsoft's repo on demand? I.e. 38 isn't the total number but the total actually seen by that PC.

That makes a lot of sense, and would explain why the OP couldn't see the American, Japanese or Chinese CAs.

Re: Government-Linked Certificate Authorities in OS X

#38

Post by smoyer »

captainmuon wrote: post #23

We should come up with a scheme where certificates are signed by multiple CAs (or you have several cross-linked certificates). If one signature changes but not the others, you know something is wrong [1]. It would be beneficial to use CAs from different political blocks, like one from the US, one from China, and one from the EU, to reduce the risk of collaboration. Of course, a MITM attacker would just strip all cert…

We should come up with a certificate authority that's distributed and based on real trust ... but who do you trust?

Re: Government-Linked Certificate Authorities in OS X

#39

Post by alfiedotwtf »

smoyer wrote: post #37

It's technically illegal for the NSA to intercept the Internet traffic of American citizens, but that doesn't mean the US Government can't supply certificates to GCHQ and company.

> It's technically illegal for the NSA to intercept the Internet traffic of American citizens

Do you really believe somebody will go to trial if they are caught spying on American citizens?

Re: Government-Linked Certificate Authorities in OS X

#40

Post by matthewmacleod »

None of them appear in my Windows PC (Windows 7)…A Windows 7 PC has 38 Certificate Authority certificates installed. My Mac OS X Yosemite has 217 Certificate Authority certificates installed.

This is a poorly-reseasrched comparison, because Windows downloads root certificates when they are first encountered (see http://support.microsoft.com/kb/931125).

"When a user goes to a secure website (by using HTTPS SSL), reads a secure email message (S/MIME), or downloads an ActiveX control that is signed (code signing), and then encounters a new root certificate, the Windows certificate chain verification software checks Microsoft Update for the root certificate. If the software finds the root certificate, the software downloads the current Certificate Trust List (CTL). The CTL contains the list of all trusted root certificates in the program and verifies that the root certificate is listed there. Then, it downloads the specified root certificate to the system and installs the certificate in the Windows Trusted Root Certification Authorities Store. If the root certificate is not found, the certificate chain is not completed, and the system returns an error. "

This means that Microsoft can add a new root certificate to a user's system at will.

I'd argue that this is actually much less secure, given that by default a Windows machine has an unauditable list of root certs, which change based on what Microsoft supplies. That means that a third-party (let's say a government) can force Microsoft to add an arbitrary root cert to the list, and a user's machine will blindly accept certificates signed by it!

Of course the entire model is broken, if you are looking for un-crackable end-to-end security.

Post reply on HN