Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

follow.agwa.name

Post reply on HN
Print view View original

201–210 of 233 posts

Re: A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

#201

Post by brianpan »

xcrunner529 wrote: post #123
brianpan wrote: post #80

Earlier quoted context omitted.

It's not entirely about this particular certificate (although this is bad, too). This is about a certificate authority giving someone who is NOT Google, a certificate that can be used to "prove" a server is Google. Accidental or not, this should not happen. The "blast radius" is limited to Microsoft since they are the only ones that trust this particular certificate authority. Your non-Microsoft browser won't trust t…

Chrome uses the Windows trust store on Windows, IIRC.

I dug a little and apparently Chrome previously used the trust store of the platform but has now transitioned away from that to use their own. https://blog.chromium.org/2022/09/announcing-launch-of-chrom...

But even before they switched to this "Chrome Root Program", they have distrusted specific CAs, for example Symantec in 2017. https://security.googleblog.com/2017/09/chromes-plan-to-dist...

Re: A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

#203

Post by bawolff »

layer8 wrote: post #39
cjalmeida wrote: post #11

It gets worse. ICP-Brasil, the AC mentioned in the bug reports, the the government run agency responsible for all things related to digital signatures. Digitally signing a contract, a deed, accessing tax returns…

Unlike web browsers, digital signature use cases should perform revocation checks, so revoking the google.com certificate should solve that.

Just need to DoS the revocation server right before your digital signature is checked.

Re: A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

#204

Post by bawolff »

raincole wrote: post #82
danpalmer wrote: post #2

This is a bad look. I expected the result would be Chrome and Firefox dropping trust for this CA, but they already don't trust this CA. Arguably, Microsoft/Windows trusting a CA that the other big players choose not to trust is an even worse look for Microsoft.

How bad is it? (Genuine question from me who lacks cybersecurity knowledge)

Well now that everyone knows about it, its a whole lot less bad.

The bad certificate was caught, and caught quickly. The system works.

It is a bit like if airport security catches someone who wanted to bomb a plane. Yes the immediate gut reaction is that is terrible, but if you think about it for a bit its actually reassuring, since its proof the safe guards worked.

Re: A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

#206

Post by bawolff »

MattPalmer1086 wrote: post #163

Things like this make me wonder why certificates are not also signed by the certificate owner. Right now, a CA can issue a certificate for any public key and domain they like. A rogue trusted CA can intercept all traffic. If a certificate also included a signature by the owner of the public key signed by the CA (using their private key, signed over the CA signature), then a CA would no longer have this ability. What…

The entire point of a CA is to verify public keys. If the certificate owner already has a verified public key (to sign the certificate with), there would be no need for a CA.

Re: A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

#207

Post by bawolff »

MattPalmer1086 wrote: post #181
3np wrote: post #166

Earlier quoted context omitted.

> What am I missing? Infrastructure and processes for key distribution and revocation. Reusing the existing PKI infrastructure used for CA trust roots won't handle it. Perhaps public keys/certs could be distributed over DNS, like for DANE (or maybe even using DANE)? Not saying it can't be done, just to point out how it's not trivial and requires buy-in from incumbents across the ecosystem. https://en.wikipedia.org/wi…

Oh sure, any change to X.509 certs would require a lot of change. I'm not sure it would make much difference to most of the existing PKI infrastructure though. CAs wouldn't see any difference. For example, currently this is what happens: 1. Owner: generate CSR and send to CA 2. CA: validates owner identity, signs cert and returns cert to owner. All we would then add is: 3. Owner: signs cert with own private key and u…

This doesn't make sense to me. What would you be trying to prove/show with step 3? How would it be different from the status quo?

Re: A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

#208

Post by 0xbadcafebee »

Lol. "This is pretty bad. Someone circunvented the ban on emitting public certificates but also disrespected Google's CAA rules. Hope this CA gets banned on Microsoft OSes for good."

Yeah, this is after the certificate was issued, and my guess, used.

Also, has anyone tried to look up CT logs lately? I tried. Can get maybe a single FQDN if you look, but trying to do wildcards or name-alikes, nothing worked. Most of the CT searching websites were straight up broken. Clearly nobody is actually looking at CT logs.

CAs are a joke. There's a dozen different ways to exploit them, they are exploited, and we only find out after the fact, if it's a famous enough domain.

We could fix it but nobody gives a shit. Just apathy and BAU.

Re: A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

#209

Post by bawolff »

mattfields wrote: post #121

Speculative guess, but it sounds like intentional collusion/coercion between government and big corporations. ie: Brazilian government demands Microsoft to grant them MITM access from Windows machines, in order for the right to do business in the country.

That seems very unlikely to me.

Governments are usually sneaky with their evil plans. It is simply too hard to get away with something like that to make it a viable. Case in point, the fact you are reading about it on hn.

Re: A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

#210

Post by estebarb »

mnau wrote: post #44
awinter-py wrote: post #25

Earlier quoted context omitted.

what's the state's interest in having their CA built into windows?

E.g. identity verification. My state has a "qualified" certificate that can be used to sign contracts and basically everything else you can do in-person. When you can transfer you home with that, there are higher requirements on checking the identity of a person who gets the certificate. That CA is not used for much else and is basically confined to our state. But it has to be in Windows, otherwise no other software…

It doesn't have to be. In Costa Rica the Central Bank has their own CA for the same purpose. We need to download the certificates ourselves. It is inconvenient, but an error by that CA won't propagate to the rest of the world.
Post reply on HN