Live data from Hacker News

Government-Linked Certificate Authorities in OS X

zitseng.com

51–60 of 88 posts

Re: Government-Linked Certificate Authorities in OS X

#51

I'm not sure that this is particularly interesting news. For starters, when "the government" wants to spy on you, they generally want to do so in such a way as to not reveal that they are doing so - using their own CA is a big tell that something fishy is going on (yes, only if you have the know-how and inclination to do so, but I'm thinking that this is probably the case for most people trying to keep secrets from t…

I agree, this is not really breaking news. The reality is that any company that wants to operate within the confines of the law can be compelled to work against its purported customers -- no one wants to go to jail because of your website.

One nit to pick: obtaining Verisign's root CA key isn't enough to decrypt traffic over the wire. That would just allow Uncle Sam to issue fake certs that appear to be from Verisign. I think that savvy users might still notice that their cert looks different now (fingerprint, expiration, other details), and put the pieces together. Maybe you use a CA whose root key hasn't been obtained yet. I highly doubt the NSA or whomever would let a fake but validly signed cert into the wild where it can be captured and used to prove their capabilities once and for all.

They might use such a cert in a controlled environment where they are going to seize the target's system in a few minutes, I suppose. Instead, what they really need is either a way to break 2048-bit RSA (not inconceivable) or a way to get your real cert's private key.

To your point about trust and CAs: I don't think it's truly a matter of trust. Verisign, GlobalSign, Digicert, Entrust, et. al. are all businesses. They are not inherently untrustworthy (nor trustworthy), they do what they must to be profitable and stay in business. It turns out that end user trust is substantially less important to that equation than remaining in compliance with the government of their host country.

I don't know how you solve that problem. The best thing about the early Internet was that, while heavily US-centric, it was often able to fly under the radar of government oversight and, to an extent, the rule of unpleasant laws. That's no longer possible. The Internet is a source of power and money, and now it has to contend with the oversight and regulation of thousands of governments doing what they do.

Re: Government-Linked Certificate Authorities in OS X

#52
post #42
post #38

Earlier quoted context omitted.

We should come up with a certificate authority that's distributed and based on real trust ... but who do you trust?

Not exactly distributed, but it is based on a somewhat different trust model than conventional CAs: https://letsencrypt.org/ It remains to be seen if it actually makes an impact upon launch. It certainly can't replace all the types of certs in use today.

Let's encrypt is the exact same trust model as conventional CAs selling you a DV certificate. Apart from that, the trust model in the public CA system does not and cannot vary by CA: you trust them all, equally, all the time.

Re: Government-Linked Certificate Authorities in OS X

#53
post #52
post #42

Earlier quoted context omitted.

Not exactly distributed, but it is based on a somewhat different trust model than conventional CAs: https://letsencrypt.org/ It remains to be seen if it actually makes an impact upon launch. It certainly can't replace all the types of certs in use today.

Let's encrypt is the exact same trust model as conventional CAs selling you a DV certificate. Apart from that, the trust model in the public CA system does not and cannot vary by CA: you trust them all, equally, all the time.

Sorry, I meant the nature of the CA as a public benefits corporation that is more open than conventional CAs. Meaning maybe I personally trust them a bit more than Verisign -- although I haven't decided if I do, and really any CA will betray you rather than go to jail on your behalf.

Their certs are indeed the same DV type as always.

Re: Government-Linked Certificate Authorities in OS X

#57
post #42
post #38

Earlier quoted context omitted.

We should come up with a certificate authority that's distributed and based on real trust ... but who do you trust?

Not exactly distributed, but it is based on a somewhat different trust model than conventional CAs: https://letsencrypt.org/ It remains to be seen if it actually makes an impact upon launch. It certainly can't replace all the types of certs in use today.

I'm planning on encrypting all my static sites once letsencrypt is available. I don't pass private data (currently) but if it's free why not?

Re: Government-Linked Certificate Authorities in OS X

#58
post #37

It's technically illegal for the NSA to intercept the Internet traffic of American citizens, but that doesn't mean the US Government can't supply certificates to GCHQ and company.

If American values are so great, why do they stop at American borders? Ok, I know why. But it's infuriating to watch the U.S Government throw it's weight around in other countries under the guise of spreading democracy or "cooperation", but then operating like a totalitarian police state anywhere it sees fit. It's not O.K. that Americans get a better deal than everyone else when it comes to privacy and security. Espe…

I agree (with you - not my government)

Re: Government-Linked Certificate Authorities in OS X

#59

Why doesn't the browsers collect information from its users (if they agree to it) about which CAs are used by which domains - and display a strong warning if a different CA than the norm tries to issue a certificate?

Users don't react well to such warnings, but on the software side there is the emergent concept of certificate pinning -- Chrome, for instance, reports to the mothership if an unexpected CA is found to have generated a Google certificate (it simply flags on an unexpected certificate, though usually that means an untrusted CA). Not sure about the scalability of the solution, but ultimately domains should be able to securely delegate authoritative CAs.

https://www.imperialviolet.org/2011/05/04/pinning.html

However then you get to the same market issue that allowed the whole Superfish and related debacles -- Enterprises require the ability to self-CA everyone else given that they demand the right to MITM.

Re: Government-Linked Certificate Authorities in OS X

#60
post #37

It's technically illegal for the NSA to intercept the Internet traffic of American citizens, but that doesn't mean the US Government can't supply certificates to GCHQ and company.

> It's technically illegal for the NSA to intercept the Internet traffic of American citizens Do you really believe somebody will go to trial if they are caught spying on American citizens?

Yes, someone will. Not the ones who get caught but the ones who caught them, e.g., Ed Snowden.

I know Snowden isn't in jail, but it isn't for lack of trying or will from the USG, only because they couldn't get their hands on him.

Post reply on HN