121–130 of 233 posts
ie: Brazilian government demands Microsoft to grant them MITM access from Windows machines, in order for the right to do business in the country.
This is a bad look. I expected the result would be Chrome and Firefox dropping trust for this CA, but they already don't trust this CA. Arguably, Microsoft/Windows trusting a CA that the other big players choose not to trust is an even worse look for Microsoft.
How bad is it? (Genuine question from me who lacks cybersecurity knowledge)
A MitM attack can be easily carried out by someone in control of an ISP, or someone in control of a WiFi network. So, if you trust your ISP and your WiFi network, realistically you have nothing to worry about.
The reason that this issued certificate could allow an attack like this to happen is because all websites nowadays use HTTPS connections, and certificate authorities are the entities that tell your web browser that certain certificates are legit. They confirm that a website is actually that website.
If you visit some website and someone tries to do a MitM attack between your web browser and that website, the web page should fail to load because if they try to change the certificate, your web browser should reject it because it is invalid.
Can someone explain what could be done with that and by whom?
It's not entirely about this particular certificate (although this is bad, too). This is about a certificate authority giving someone who is NOT Google, a certificate that can be used to "prove" a server is Google. Accidental or not, this should not happen. The "blast radius" is limited to Microsoft since they are the only ones that trust this particular certificate authority. Your non-Microsoft browser won't trust t…
Earlier quoted context omitted.
CAs are in the business of being a trusted third party that, among other things, verifies the identity of things. In this case someone seems to have scammed/hacked/whatever the CA into issuing a certificate for google.com, which is clearly bogus. So the result is that we should not trust this CA anymore.
But why would someone hacked a CA to just... issue a certificate for google.com? How does it benifit them? I'd imagine they issue a certficate for some phishing sites or something.
The reason someone would want to to be able to issue one of these certs is it essentially allows them to eavesdrop on normally unreadable connection data because the device thinks the system in the middle is actually a trustworthy endpoint, and not a malicious TLS terminating proxy.
No one whose devices are by default trusting that CA now have any guarantee of confidentiality on any connection to a system presenting those issued certs.
Tangentially related: The system is deeply flawed, which is something I realized fifteen years ago when I was put into a situation where I had to use online banking. (Had to being the nearest branch of any bank was an hour long flight away, though there was an ice road you could use in the winter.) One of my first questions of the bank was: who issued their certificate. They didn't have a clue what I was talking abou…
> One of my first questions of the bank was: who issued their certificate …what did the certificate say? > whole process was based upon blind trust If I offer someone a ride and they start quizzing me on what differential I’m driving, I’m going to ignore them. That isn’t requiring blind trust, it’s just the wrong place and way to get the information you’re asking for.
When I was in schooling getting filled in on Web of Trust, I about ground that particular day's class to a halt because I couldn't imagine the world was that cavalier on such a thing.
Lo and behold, I realized shortly afterward it absolutely was the case, and there was nada I could do to change it except figure out how to get normal people universally fluent and invested in basic cryptography so they could manage their own trust networks. You can imagine how well that's gone.
It gets worse. ICP-Brasil, the AC mentioned in the bug reports, the the government run agency responsible for all things related to digital signatures. Digitally signing a contract, a deed, accessing tax returns…
Earlier quoted context omitted.
CAs are in the business of being a trusted third party that, among other things, verifies the identity of things. In this case someone seems to have scammed/hacked/whatever the CA into issuing a certificate for google.com, which is clearly bogus. So the result is that we should not trust this CA anymore.
But why would someone hacked a CA to just... issue a certificate for google.com? How does it benifit them? I'd imagine they issue a certficate for some phishing sites or something.
Basically the way certificates work is that whoever has a certificate for a domain name will be able to serve anything they want and browsers will accept this is the real domain. To turn this into an attack, they just need to trick your DNS into pointing your to their machine, or to intercept your traffic even while you're accessing the real server.
Getting a certificate for "mytotallyrealnotascamwinkwink.phishing.com" is not useful in any way for an attacker: the whole idea is to have the user think they are on a trusted site like google.com, while in reality looking at the attacker's site.
This is a bad look. I expected the result would be Chrome and Firefox dropping trust for this CA, but they already don't trust this CA. Arguably, Microsoft/Windows trusting a CA that the other big players choose not to trust is an even worse look for Microsoft.
Microsoft have a terrible reputation for security, which they've earned through doing stuff like this.
It's not likely to get any better any time soon either, as their trajectory is still pointed downwards.