The biggest problem with MITM is not interception it is potential manipulation. Despite being a clear violation of your constitutional rights we must look beyond this at what is clearly the bigger issue: can we trust the legitimacy of any information encoded into a digital form when organizations such as the NSA and FBI have immense amounts of power to tamper with connections. Evidence can clearly be misrepresented, manipulated, or even planted on unsuspecting Americans by our government or other foreign governments.
Government-Linked Certificate Authorities in OS X
61–70 of 88 posts
Re: Government-Linked Certificate Authorities in OS X
#62There's an open bug report about adding the Federal Common Policy CA to Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=478418
Seem's like a really dodgy justification...
Re: Government-Linked Certificate Authorities in OS X
#63None of them appear in my Windows PC (Windows 7)…A Windows 7 PC has 38 Certificate Authority certificates installed. My Mac OS X Yosemite has 217 Certificate Authority certificates installed. This is a poorly-reseasrched comparison, because Windows downloads root certificates when they are first encountered (see http://support.microsoft.com/kb/931125 ). "When a user goes to a secure website (by using HTTPS SSL), read…
Apple can also push new certs through system updates.
So can Microsoft. The difference between Microsoft's "Search and pull" means that Apple needs to bump OS X's revision number or apply a Security Update, both which are visible as a red badge on the "Updates" tab of the Mac App Store. Microsoft doesn't need to even apply a super generic KB update.
Re: Government-Linked Certificate Authorities in OS X
#64The OSX trusted root can be viewed with the Keychain Access tool. I've removed a lot of CAs I don't trust. There is also (at least one) a project that tracks changes in trust stores in OS:es, Java, browsers: https://github.com/kirei/catt (I am one of the authors.)
Yeah - total band-aid fix for a broken system (CA) but here's how to remove them for anyone interested: https://github.com/sammcj/delete-unknown-root-ca
Band-aid gives relief locally and temporaily. Add a new band-aid when the old one does not stick anymore.
If band-aid is what we got before the system is fixed, then that is what we can use.
Re: Government-Linked Certificate Authorities in OS X
#65With certificate pinning, the chances that malicious use of certificates by rogue CAs goes undetected have decreased a lot. For Firefox, use CertPatrol: • http://patrol.psyced.org/ • https://addons.mozilla.org/en-US/firefox/addon/certificate-p... Also, a few websites are starting to use DNSSEC with TLSA and DANE. There's also a Firefox plugin for that at https://www.dnssec-validator.cz/
I love the concept of certificate pinning, but I don't see how it solves the core problem:
User: Why should I trust this root CA to secure this domain?
Domain Owner: How can I specify which root CA should be trusted to secure this domain?
If neither of these parties are significantly involved in the trust decision, how can it be said that trust has been established at all?
Most pinning implementations seem to either delegate the trust to someone else (browsers, OS, libraries, etc.) or blindly trust the information presented in the first encounter. This is no different than the historical model. There's nothing preventing any application from presenting a warning when a known certificate changes or a new one is encountered, so what does pinning offer other than extra complexity?
Locally cached relationships aren't any more viable than using an /etc/hosts file for the whole Internet (and pose additional privacy concerns). Leveraging DNS is a worthy goal, but if it was secure enough for this purpose, it would eliminate the need for pinning because a domain owner could confidently present its public key via DNS.
I believe in defense in depth, and this work is important, but we seem to be making little progress in solving the fundamental problem of establishing trust. Maybe it's as unsolvable on the Internet as it is in the real world.
Re: Government-Linked Certificate Authorities in OS X
#66> I’ve been sitting on this information for some time, waiting to get more research done before I publish a post.
You've been sitting on common knowledge for some time? Research into what?
Sorry but this is a very well known issue with HTTPS that has been discussed in depth for the last few years, in particular with people suggesting alternatives and improvements to HTTPS (like certificate pinning, Convergence[0], etc).
The fact the author thinks they have found some type of unknown or smoking gun says more about the author than anything. I mean heck you can go back and find tons of examples of root CAs "mistakenly" generating fake certificates for things like Google or Windows Update. You can also read about entire countries being victim of it [1].
[0] http://convergence.io/ [1] http://www.bbc.com/news/technology-14789763
Re: Government-Linked Certificate Authorities in OS X
#67This is not news. The CA system is broken by design. It's been this way from the start. Not just on OSX but on all platforms. Your browser blindly trusts a list of a few hundred CA's, any of which can impersonate any SSL site you visit at any time (except for the chosen few that use certificate pinning) Many of the biggest CA's (e.g. Verisign) are under government control.
It doesn't have to be this way though. The browsers could start not trusting those CAs, and not allowing them to impersonate any SSL site you visit, and they are making steps towards this with measures like pinning aren't they? Measures like that just need to be made the default, and if companies want the ability to MITM they should have to adjust settings to make that happen, but consumers should not be vulnerable t…
Browsers shouldn't be making the decision of who to trust or not trust. They should be presenting the information for the user to decide. If the user decides to trust the US government more, that is their choice. The browser should inform, but not make that decision for the user. The only thing the browser should be doing is making it as difficult as possible for that decision to be subverted.
Re: Government-Linked Certificate Authorities in OS X
#68> I’ve been sitting on this information for some time, waiting to get more research done before I publish a post. You've been sitting on common knowledge for some time? Research into what? Sorry but this is a very well known issue with HTTPS that has been discussed in depth for the last few years, in particular with people suggesting alternatives and improvements to HTTPS (like certificate pinning, Convergence[0], et…
Maybe those improvements never goes anywhere because whenever someone tries to make some noise about the problems they are meet with this superior attitude. The people who know about it and act likes everything is fine, when not to being smug about it, are the ones who should be feeling bad.
Re: Government-Linked Certificate Authorities in OS X
#69None of them appear in my Windows PC (Windows 7)…A Windows 7 PC has 38 Certificate Authority certificates installed. My Mac OS X Yosemite has 217 Certificate Authority certificates installed. This is a poorly-reseasrched comparison, because Windows downloads root certificates when they are first encountered (see http://support.microsoft.com/kb/931125 ). "When a user goes to a secure website (by using HTTPS SSL), read…
The list of root certs is distributed as an update through Windows update. It is not just an on-demand root cert. An organization that vets updates before applying them to production systems will also need to vet such an update.
The updates are indeed very auditable. Any organization who chooses to selectively apply updates will not have new root certs appear out of channel.
Of course Microsoft needs to be able to update the root cert list. It has been used to remove certs as well (Diginotar). However, when they do so, it needs to be transparent. Windows Update is transparent. The very article you linked even goes into details about this.
Which means that your claim that "Microsoft can add a new root certificate to a user's system at will" is false. If you do not automatically install all updates or if you use WSUS, root certs will only be updates if you allow the update through.
The process outlined in your linked article describes how Windows will attempt to find and install the Windows Update package from the cert chain. This does NOT bypass the Windows Update mechanism; it merely looks for a package in the catalog with the root cert that was requested by following the chain.
Re: Government-Linked Certificate Authorities in OS X
#70Most of the certs listed in the blog post are in Mozilla's trust store[1] and in Windows trust store[2] as well. [1] https://www.mozilla.org/en-US/about/governance/policies/secu... [2] (PDF) http://download.microsoft.com/download/1/5/7/157B29AB-F890-4...
Yep. From a Ctrl+F of [1], there's: * ApplicationCA (Japan) * China Internet Network Information Center EV Certificates Root (China) From a Ctrl+F of [2], there's: * ApplicationCA (Japan) * FPKI Common Policy (US) * China Internet Network Information Center EV Certificates Root (China) The only odd one out seems to be DoD Root CA 2.
To my best knowledge, activists from China did plead to remove CNNIC (China Internet Network Information Center) root cert from Mozilla Firefox but failed.
That cert was added as
https://bugzilla.mozilla.org/show_bug.cgi?id=476766
and the plea for removal
https://bugzilla.mozilla.org/show_bug.cgi?id=542689
Till now, CNNIC CA cert is part of builtin authority bundled in Firefox.
CNNIC was a controversial organization not only because of its govn't background but also its involvement with an infamous malware years ago.
And I cannot get access to bugzilla.mozilla.org without using a secure proxy from China as 'Server aborted the SSL handshake'.