A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

Post by echoangle » Sun, Dec 01, 2024, 9:54 AM UTC

II2II wrote: post #85

Tangentially related: The system is deeply flawed, which is something I realized fifteen years ago when I was put into a situation where I had to use online banking. (Had to being the nearest branch of any bank was an hour long flight away, though there was an ice road you could use in the winter.) One of my first questions of the bank was: who issued their certificate. They didn't have a clue what I was talking abou…

Post by echoangle » Sun, Dec 01, 2024, 10:01 AM UTC

bufferoverflow wrote: post #29

woofcat wrote: post #22

Earlier quoted context omitted.

Whomever has this fake certificate can run a server and say it's google.com and windows will say "yep you are" with the little green lock.

The certificate is for a specific IP address, no? And without DNS pointing google.com to that IP address, it's pretty useless.

Post by justinclift » Sun, Dec 01, 2024, 10:05 AM UTC

danpalmer wrote: post #138

justinclift wrote: post #130

Earlier quoted context omitted.

> an even worse look for Microsoft. Microsoft have a terrible reputation for security, which they've earned through doing stuff like this. It's not likely to get any better any time soon either, as their trajectory is still pointed downwards.

I don’t know enough to comment on that reputation, but this surprises me. They’re known for being great at serving and selling to the enterprise, frequently at the expense of end users, and big enterprises/govts care a lot about security usually. Even if much of that caring is box ticking rather than actually looking into the security (hello ISO27001), you’d expect it to result in generally a security conscious cultu…

  "Throughout this review, the board identified a series of
  Microsoft operational and strategic decisions that collectively
  points to a corporate culture that deprioritized both enterprise
  security investments and rigorous risk management," the report
  reads.

Post by JumpCrisscross » Sun, Dec 01, 2024, 10:10 AM UTC

salawat wrote: post #127

JumpCrisscross wrote: post #86

Earlier quoted context omitted.

> One of my first questions of the bank was: who issued their certificate …what did the certificate say? > whole process was based upon blind trust If I offer someone a ride and they start quizzing me on what differential I’m driving, I’m going to ignore them. That isn’t requiring blind trust, it’s just the wrong place and way to get the information you’re asking for.

The problem with that analogy is that the cert issuer isn't a mere component of the car, but the entire car in this instance. That cert being trustworthy is the entire point. When I was in schooling getting filled in on Web of Trust, I about ground that particular day's class to a halt because I couldn't imagine the world was that cavalier on such a thing. Lo and behold, I realized shortly afterward it absolutely was…

Post by Muromec » Sun, Dec 01, 2024, 10:24 AM UTC

danpalmer wrote: post #138

justinclift wrote: post #130

Earlier quoted context omitted.

> an even worse look for Microsoft. Microsoft have a terrible reputation for security, which they've earned through doing stuff like this. It's not likely to get any better any time soon either, as their trajectory is still pointed downwards.

I don’t know enough to comment on that reputation, but this surprises me. They’re known for being great at serving and selling to the enterprise, frequently at the expense of end users, and big enterprises/govts care a lot about security usually. Even if much of that caring is box ticking rather than actually looking into the security (hello ISO27001), you’d expect it to result in generally a security conscious cultu…