Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

follow.agwa.name

Post reply on HN
Print view View original

221–230 of 233 posts

Re: A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

#221

Post by aaomidi »

0xbadcafebee wrote: post #208

Lol. "This is pretty bad. Someone circunvented the ban on emitting public certificates but also disrespected Google's CAA rules. Hope this CA gets banned on Microsoft OSes for good." Yeah, this is after the certificate was issued, and my guess, used. Also, has anyone tried to look up CT logs lately? I tried. Can get maybe a single FQDN if you look, but trying to do wildcards or name-alikes, nothing worked. Most of th…

Give me a grant of a few million a year and we could do significant improvements here :P

Re: A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

#223

Post by march_happy »

leonidasv wrote: post #20

ICP-Brasil officially stopped emitting public-facing SSL/TLS certificates in October: https://www.gov.br/iti/pt-br/assuntos/noticias/indice-de-not... This is pretty bad. Someone circunvented the ban on emitting public certificates but also disrespected Google's CAA rules. Hope this CA gets banned on Microsoft OSes for good.

Checked certlm.msc, a hot fix seems to be already pushed as I can't see ICP Brasil under Trusted Root Certification.

Re: A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

#224

Post by resters »

8organicbits wrote: post #179
salawat wrote: post #147

Earlier quoted context omitted.

I mean... It's as easy as getting SSL certs and importing them into a trust store/adding them to a directory. The hard part is getting the people you want to establish a trust relationship with to give you a copy of their key. Web of Trust was the answer to logistical key distribution problem. The idea being there would be an organization that would vet people and vouchsafe their cryptographic material for everyone e…

Web of trust is way more ambitious than what I'm talking about. Key distribution for the Apple, Microsoft, Google, and Mozilla trust stores is already a solved problem and works well at scale already. However, if you don't trust the inclusive nature of Microsoft's trust store and prefer Chrome's, there should be a tool to swap out trust stores. I don't think such a tool exists yet.

Right. I'm imagining a tool that would let users impose choices such as the following:

- Accept any certs trusted by Bruce Schneier unless they are not trusted by tptacec

- Do not accept new certs for top 1000 domain names unless they are over 7 days old and trusted by the Mozlla Foundation

Various experts could create the rules they use to decide which certs or CAs they trust and users could decide which high profile authority figures or institutions they want to trust. One example might even be "Bruce Schneier paranoid version"

I think this doesn't exist because of the following:

1) technically it is possible to do it today with the existing tools, even though nobody does it

2) the negative impact of trusting certs one shouldn't is low for the average user

3) sophisticated users already take precautions and are rarely fooled

I think for something like this to work it would have to be extremely simple. Surely there would be the same phenomenon as "Dr. Oz" in the realm of cyber secruity. Maybe the 'Kevin Rose settings" would be popular, etc. But that would still open the door to distributed trust which is an improvement over blanket trust of large corporate entities.

Re: A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

#225

Post by tsimionescu »

amluto wrote: post #195
tsimionescu wrote: post #189

Earlier quoted context omitted.

It is given the design of the PKI and DNS. There's no relation between CA and the TLDs on the certificate being signed.

This is true, but it’s an old design that has been (in my opinion at least) obviously wrong since the very beginning of HTTPS. Microsoft could easily fix it, at least for clients that can manage to use an updated API.

Microsoft has nowhere near the power to change the PKI and/or DNS. And it's not an API problem, it's a problem of where companies go to get their legitimate certs. If there are a lot of companies getting their certs for international TLDs from country CAs, or country TLDs from international CAs, then you have to wait for huge systemic changes before enforcing any kind of TLD-CA relationship.

Re: A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

#226

Post by MattPalmer1086 »

bawolff wrote: post #207
MattPalmer1086 wrote: post #181

Earlier quoted context omitted.

Oh sure, any change to X.509 certs would require a lot of change. I'm not sure it would make much difference to most of the existing PKI infrastructure though. CAs wouldn't see any difference. For example, currently this is what happens: 1. Owner: generate CSR and send to CA 2. CA: validates owner identity, signs cert and returns cert to owner. All we would then add is: 3. Owner: signs cert with own private key and u…

This doesn't make sense to me. What would you be trying to prove/show with step 3? How would it be different from the status quo?

It doesn't help at all, just a poorly thought out idea.

Re: A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

#227

Post by tsimionescu »

withinboredom wrote: post #172
tsimionescu wrote: post #132

Earlier quoted context omitted.

So that they don't depend on anyone else to have proper TLS for their state sites and for companies operating in their state. Imagine if you don't have a state CA, and your relationship with the USA goes sour, and the USA prohibits all of their major CAs from doing business with your country, including Let's Encrypt. People in your country still use the internet and you still want to protect them from scammers preten…

This seems like a matter of signing a certificate signed by an actual CA with your own CA as well. If the relationship sours, you still have your own CA to vouch for it.

That doesn't achieve anything at a country level if trust stores don't include your CA directly. A country can't just push an update to all its citizens' computers to switch CA, it has to plan ahead for such eventualitites.

Re: A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

#228

Post by kurthr »

alwayslikethis wrote: post #212

I wonder why Brazil has their CA trusted by Microsoft in the first place, while Kazakhstan [1], for example, wasn't. 1. https://en.wikipedia.org/wiki/Kazakhstan_man-in-the-middle_a...

The Brazilian government buys windows licenses in bulk.

Re: A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

#229

Post by dadrian »

8organicbits wrote: post #100
tptacek wrote: post #97

Earlier quoted context omitted.

Users can tune their own trust stores.

Is there a way to do it that isn't tedious? I'm not familiar with tooling beyond the UI browsers offer, which doesn't match the experience I was trying to describe.

The next version of Chrome introduces a whole UI for this at chrome://certificate-manager.

Re: A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

#230

Post by account42 »

tsimionescu wrote: post #225
amluto wrote: post #195

Earlier quoted context omitted.

This is true, but it’s an old design that has been (in my opinion at least) obviously wrong since the very beginning of HTTPS. Microsoft could easily fix it, at least for clients that can manage to use an updated API.

Microsoft has nowhere near the power to change the PKI and/or DNS. And it's not an API problem, it's a problem of where companies go to get their legitimate certs. If there are a lot of companies getting their certs for international TLDs from country CAs, or country TLDs from international CAs, then you have to wait for huge systemic changes before enforcing any kind of TLD-CA relationship.

Microsoft has absolute power about the restrictions they support in their root store.
Post reply on HN