Why can the CN registrar sign .com certs?
Why aren't national authorities limited to their country's TLD? I'd imagine they'd want this, and the public would want this.
Its so obvious, what am I missing?
Google warns of unauthorized TLS certificates trusted by almost all OSes
61–70 of 76 posts
Re: Google warns of unauthorized TLS certificates trusted by almost all OSes
#62Central certificate authorities were all web users put their trust against money compensation to the CA are a broken security model! Especially in the new internet security era were we have government hackers with almost unlimited budgets. Governments will hack into CAs and issue fake certificates to popular domains that they want to Man in the middle attack and to that we have no protection. I think the solution is a voting mechanism or digital ID. So that the engineer working at Google can sign the certificate with a Corporate Google ID.
Central CAs is almost as broken security as credit cards with the card number readable in cleartext on the front of the card.
Re: Google warns of unauthorized TLS certificates trusted by almost all OSes
#63Earlier quoted context omitted.
I have marked CNNIC root cert untrusted on all of systems I can control. It bothers me sometimes when some providers with "good" reputation uses them, like azure china. I had to manually add the server certificate to trusted list, just to manage my vms. Otherwise, I barely notice the issue. It looks that even CNNIC certs themselves weren't widely deployed, correct me if I'm wrong, most of Chinese sites who wants to e…
If you think the company that has agreed to collaborate with a Chinese company to make a different version of Skype (Tom-Skype), for the sole purpose of letting the Chinese government spy on Chinese citizens' communications in real-time, can be "trusted" to not have backdoored cloud services in China, then I have a bridge to sell you. Microsoft has proven again and again that it's willing to make any concessions to t…
To be fair Tom-Skype predates Microsoft's buyout of Skype.
Re: Google warns of unauthorized TLS certificates trusted by almost all OSes
#64It is interesting that when the CNNIC root certificate was added to Firefox, this is exactly what many people had warned against: https://bugzilla.mozilla.org/show_bug.cgi?id=476766
IMHO, had Firefox dared remove CNNIC root cert, Mozilla would already been ousted with their business in China, like Google.
Re: Google warns of unauthorized TLS certificates trusted by almost all OSes
#65FWIW, here's what I just did on my (Arch) Linux machine: $ for f in /etc/ssl/certs/*.pem; do sudo ln -sfn "$f" /etc/ca-certificates/trust-source/blacklist/; done $ sudo update-ca-trust This will block all currently installed CAs (as well as double-block some, but that doesn't really matter). You then need to add them back in. Restart your browser, and go to websites you access frequently (change them to https:// if n…
Be careful, this has no effect if you're using firefox/iceweasel. They bring their own set of trusted CAs and ignore all changes on the OS trust store.
Re: Google warns of unauthorized TLS certificates trusted by almost all OSes
#66Has anyone gone throught the list of root certificates that are trusted in the browsers/OSes and done some homework on them? Would be interesting to see what's behind those authorities and also which certificates they have issued.
I see that in the OS X keychain I have 213 "system roots" that are trusted, I wonder how many of them I really need...
Re: Google warns of unauthorized TLS certificates trusted by almost all OSes
#67FWIW, here's what I just did on my (Arch) Linux machine: $ for f in /etc/ssl/certs/*.pem; do sudo ln -sfn "$f" /etc/ca-certificates/trust-source/blacklist/; done $ sudo update-ca-trust This will block all currently installed CAs (as well as double-block some, but that doesn't really matter). You then need to add them back in. Restart your browser, and go to websites you access frequently (change them to https:// if n…
You've said the start by blacklisting all SSL, then to inspect the SSL chain using SSL Shopper, but the link to SSL Shopper is using https. So (at least the first time), you need to inspect yet another SSL cert before you can inspect the other SSL cert you were looking at. :P
(FYI, looks like SSL Shopper uses GoDaddy for SSL)
Re: Google warns of unauthorized TLS certificates trusted by almost all OSes
#68Earlier quoted context omitted.
I have marked CNNIC root cert untrusted on all of systems I can control. It bothers me sometimes when some providers with "good" reputation uses them, like azure china. I had to manually add the server certificate to trusted list, just to manage my vms. Otherwise, I barely notice the issue. It looks that even CNNIC certs themselves weren't widely deployed, correct me if I'm wrong, most of Chinese sites who wants to e…
If you think the company that has agreed to collaborate with a Chinese company to make a different version of Skype (Tom-Skype), for the sole purpose of letting the Chinese government spy on Chinese citizens' communications in real-time, can be "trusted" to not have backdoored cloud services in China, then I have a bridge to sell you. Microsoft has proven again and again that it's willing to make any concessions to t…
This isn't just about earning market share in China. Just about any organization that operates in China (or hopes to) has a vested interest in, e.g., having reliable email access there. If your company uses Google products for email, etc., then these days you'll have some real challenges making them work for folks over there. Microsoft can capture a lot of American business that way. (Concrete fears about employees losing crucial access tend to outweigh philosophical arguments about government surveillance when folks sit down to make these decisions.)
Re: Google warns of unauthorized TLS certificates trusted by almost all OSes
#69Earlier quoted context omitted.
Looks like Mozilla has this data in aggregate, if I'm understanding this web page right: http://telemetry.mozilla.org/#filter=nightly%2F39%2FCERT_VAL... Ignore the graph and match up the table below with this C array: https://dxr.mozilla.org/mozilla-central/source/security/mana... If I'm understanding the meaning of "Bin Number" right, not all of the 0s are surprising. But some are. For instance, the AOL CA hasn't be…
You can look at the local telemetry for your current Firefox session, including this variable, by going to about:telemetry, which sort of gets you what pbhjpbhj was looking for, albeit in an inconvenient and limited fashion.
I have telemetry upload turned off which appears to then not gather the data (which is perfectly reasonable) rather than just not upload it.
Re: Google warns of unauthorized TLS certificates trusted by almost all OSes
#70The fact that it's CNNIC that has issued these dangerous certificates is not exactly relevant to the problem at hand; More than one root authority has made mistakes in delegation, and several have made the mistake of not checking the delegation bit and allowing third-parties to request intermediate certificates. Still, it bears repeating that CNNIC, which is effectively a branch of the chinese government, has a root…
I'm on FF 36.0 on Kubuntu 14.10 - I removed the certs for CNNIC and then to test went to the CNNIC website and rewrote the address as https. Website still shows the lock symbol and still shows the cert verified by the CNNIC root CA?!? Seems the removal is slightly glitchy somehow, third time worked. 2 things I notice: 1) there are a lot of default trusted suppliers, seems that this should perhaps be selected on insta…
The cert keeps reappearing in FF 36.0.4 on the Mac. How to make it go away?!
EDIT: while the cert reappears, I do get a warning going to the website with https. Nevermind.