Government-Linked Certificate Authorities in OS X
1–10 of 88 posts
Re: Government-Linked Certificate Authorities in OS X
#2When scanning through the list of CAs on my machine, so many of them sound like unknown entities who I have no idea whether or not to trust. So it's difficult deciding whether I should remove any of them or not.
What would really help in this would be to know if any of these CAs have signed certificates for popular websites. Rightly or wrongly, I'd trust a CA who has certificates in active use by many sites over an obscure foreign (or not?) government CA who doesn't seem to sign any certificates that I'd normally interact with. After all, if suddenly one day ycombinator.com's site appears to be now signed by an obscure CA, I should probably be worried.
So, is there any way to map a given CA to the subset of the top 1000/10000/whatever number of websites that have certificates signed by it? Surely some webcrawlers must have indexed a large number of site certificates and have the data to build such a database.
Re: Government-Linked Certificate Authorities in OS X
#3Here is the list as presented by Apple at their website:
http://support.apple.com/en-us/HT202858
Re: Government-Linked Certificate Authorities in OS X
#4When scanning through the list of CAs on my machine, so many of them sound like unknown entities who I have no idea whether or not to trust. So it's difficult deciding whether I should remove any of them or not. What would really help in this would be to know if any of these CAs have signed certificates for popular websites. Rightly or wrongly, I'd trust a CA who has certificates in active use by many sites over an o…
Re: Government-Linked Certificate Authorities in OS X
#5There's an open bug report about adding the Federal Common Policy CA to Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=478418
Re: Government-Linked Certificate Authorities in OS X
#6The OSX trusted root can be viewed with the Keychain Access tool. I've removed a lot of CAs I don't trust.
There is also (at least one) a project that tracks changes in trust stores in OS:es, Java, browsers:
(I am one of the authors.)
Re: Government-Linked Certificate Authorities in OS X
#7This is not news. The CA system is broken by design. It's been this way from the start. Not just on OSX but on all platforms.
Your browser blindly trusts a list of a few hundred CA's, any of which can impersonate any SSL site you visit at any time (except for the chosen few that use certificate pinning)
Many of the biggest CA's (e.g. Verisign) are under government control.
Re: Government-Linked Certificate Authorities in OS X
#8Most of the certs listed in the blog post are in Mozilla's trust store[1] and in Windows trust store[2] as well.
[1] https://www.mozilla.org/en-US/about/governance/policies/secu...
[2] (PDF) http://download.microsoft.com/download/1/5/7/157B29AB-F890-4...
Re: Government-Linked Certificate Authorities in OS X
#9When scanning through the list of CAs on my machine, so many of them sound like unknown entities who I have no idea whether or not to trust. So it's difficult deciding whether I should remove any of them or not. What would really help in this would be to know if any of these CAs have signed certificates for popular websites. Rightly or wrongly, I'd trust a CA who has certificates in active use by many sites over an o…
Maybe Google's certificate transparency is what you are looking for?
http://www.certificate-transparency.org
A more practical approach: Disable all root certificates, then enable them one by one as you are getting browser warnings.
Re: Government-Linked Certificate Authorities in OS X
#10When scanning through the list of CAs on my machine, so many of them sound like unknown entities who I have no idea whether or not to trust. So it's difficult deciding whether I should remove any of them or not. What would really help in this would be to know if any of these CAs have signed certificates for popular websites. Rightly or wrongly, I'd trust a CA who has certificates in active use by many sites over an o…
http://w3techs.com/technologies/overview/ssl_certificate/all
Awesome, thank you!