Live data from Hacker News

A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

follow.agwa.name

161–170 of 233 posts

Re: A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

#161

Earlier quoted context omitted.

> an even worse look for Microsoft. Microsoft have a terrible reputation for security, which they've earned through doing stuff like this. It's not likely to get any better any time soon either, as their trajectory is still pointed downwards.

I don’t know enough to comment on that reputation, but this surprises me. They’re known for being great at serving and selling to the enterprise, frequently at the expense of end users, and big enterprises/govts care a lot about security usually. Even if much of that caring is box ticking rather than actually looking into the security (hello ISO27001), you’d expect it to result in generally a security conscious cultu…

Company pushing constant snooping of all activity of users even on professional/enterprise variants of their OS can't be taken seriously re security, so absolutely no idea where this rumor 'They’re known for being great at serving and selling to the enterprise' comes from.

They may be good when luring in customers, but once thats done, they don't give a fuck about anything but their current cash flow. And the fact that ultra-big players can ask them for customized OS distribution that has this turned off (just like my own mega corporation) doesn't change anything on statements above.

Re: A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

#162
post #58
post #27

Earlier quoted context omitted.

States are themselves extraordinarily large IT enterprises, they generally want control of traffic and its transparency or protection, and they are large enough to get arrangements for that, though usually not this particular arrangement. Large enterprises in the US generally have the same capability, but not loaded into operating systems by default (that is: Walmart's ability to do this on its own network in no way…

If you're a large enterprise, then it's trivial to add yourself your own custom CA and save the cost/hassle of needing to deal with outside companies. The tradeoff being you need to manage it yourself vs basically paying this third party company to survive?

> If you're a large enterprise, then it's trivial to add yourself your own custom CA

The big CA have their own "Boy club". See Ahmed used cars and certificates.

Re: A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

#163
Things like this make me wonder why certificates are not also signed by the certificate owner.

Right now, a CA can issue a certificate for any public key and domain they like. A rogue trusted CA can intercept all traffic.

If a certificate also included a signature by the owner of the public key signed by the CA (using their private key, signed over the CA signature), then a CA would no longer have this ability.

What am I missing?

Re: A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

#164

Earlier quoted context omitted.

To be clear, this is bog standard in all mega-corps now. They have a vendor product that provides HTTP Internet proxy, then they perform MitM to decrypt HTTPS traffic and re-sign/encrypt with in-house issued cert. Then, this cert is auto-trusted as part of all base OS installations. To be honest, how else can mega-corps spy on HTTPS traffic without this MitM tactic? I don't know any other way.

Yes, but normally this is done by making your own CA and installing it into your client devices, not by getting it into every device globally by working with Microsoft.

> Yes, but normally this is done by making your own CA and installing it into your client devices, not by getting it into every device globally by working with Microsoft.

Google, Facebook, Microsoft, Apple, Cloudfare, Godaddy, Lets encrypt. They all "work with Microsoft".

Re: A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

#165

Earlier quoted context omitted.

From a security standpoint that's debatable. Multiple RCEs and critical CVEs cannot be fixed because Microsoft "lost" the source code. So they disclosed those RCEs but without any solution or fix. (Not kidding, sadly, look it up, there also have been occasional binary patches because of the same reason) [1] https://msrc.microsoft.com/update-guide

Do you have a link for the „lost sourcecode so we won’t patch“ claim? The link you gave just gives me a long list of patches.

CVE-2017-11882 and the NTLM relay attack come to mind, for example. Down the line they weren't actually fixed, and are continuously being used by a lot of ransomware / malware campaigns.

I remember some Windows Fax Service related CVEs and some Wi-Fi drivers that couldn't be fixed directly, too, but don't remember the CVE or whether that was related to the Broadcom driver/module sideloading fuckup.

> The link you gave just gives me a long list of patches.

The link I gave you is the only disclosure/advisory page that Microsoft offers, don't blame me for them not offering a better UI. Ask them to do better.

- https://nvd.nist.gov/vuln/detail/CVE-2017-11882

- https://blog.0patch.com/2017/11/did-microsoft-just-manually-...

- https://cert.europa.eu/publications/security-advisories/2022...

Re: A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

#166

Things like this make me wonder why certificates are not also signed by the certificate owner. Right now, a CA can issue a certificate for any public key and domain they like. A rogue trusted CA can intercept all traffic. If a certificate also included a signature by the owner of the public key signed by the CA (using their private key, signed over the CA signature), then a CA would no longer have this ability. What…

> What am I missing?

Infrastructure and processes for key distribution and revocation. Reusing the existing PKI infrastructure used for CA trust roots won't handle it. Perhaps public keys/certs could be distributed over DNS, like for DANE (or maybe even using DANE)?

Not saying it can't be done, just to point out how it's not trivial and requires buy-in from incumbents across the ecosystem.

https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Na...

I like your general idea of improving the status quo by adding decentralized/self-managed trust on top of/alongside the existing centralized PKI. Could be a stepping stone towards something more systematically resilient.

Re: A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

#167
post #164

Earlier quoted context omitted.

Yes, but normally this is done by making your own CA and installing it into your client devices, not by getting it into every device globally by working with Microsoft.

> Yes, but normally this is done by making your own CA and installing it into your client devices, not by getting it into every device globally by working with Microsoft. Google, Facebook, Microsoft, Apple, Cloudfare, Godaddy, Lets encrypt. They all "work with Microsoft".

Does any employer get a certificate from any of the CAs you listed to MITM their internal networks?

Re: A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

#168

This is a bad look. I expected the result would be Chrome and Firefox dropping trust for this CA, but they already don't trust this CA. Arguably, Microsoft/Windows trusting a CA that the other big players choose not to trust is an even worse look for Microsoft.

Funny thing is this is just the latest issue around this CA. For a long time you had to manually add it to certificate store because it was not trusted by default but the Brazilian government insisted in using it on official websites.
Post reply on HN