31–40 of 233 posts
Earlier quoted context omitted.
Yes; malice is indefensible no matter the circumstances, mistakes may be defensible under certain circumstances or with certain responses by the mistakee.
as a brazilian i’m not sure if I’d prefer it to be malice or incompetence
This is a bad look. I expected the result would be Chrome and Firefox dropping trust for this CA, but they already don't trust this CA. Arguably, Microsoft/Windows trusting a CA that the other big players choose not to trust is an even worse look for Microsoft.
Not clear (to me) in the original post -- was this done accidentally or intentionally?
As a CA, how does one accidentally issue a certificate for google.com? I mean, is there a scenario that isn't malicious?
Earlier quoted context omitted.
Whomever has this fake certificate can run a server and say it's google.com and windows will say "yep you are" with the little green lock.
The certificate is for a specific IP address, no? And without DNS pointing google.com to that IP address, it's pretty useless.
If they were issued for IP addresses they would have to reissue the certificate every time they spun up a new server. Also it's why if you spin up another server and make DNS point google.com to that server, it would not pass verification since the certificate you will be using on that server is not issued to *.google.com, but rather some other domain you own. The IP address plays no role in certificates.
ICP-Brasil officially stopped emitting public-facing SSL/TLS certificates in October: https://www.gov.br/iti/pt-br/assuntos/noticias/indice-de-not... This is pretty bad. Someone circunvented the ban on emitting public certificates but also disrespected Google's CAA rules. Hope this CA gets banned on Microsoft OSes for good.
[flagged]
Earlier quoted context omitted.
What is even the point of a web CA that isn't trusted by all of the major players? Is there one?
I suppose it allows you to enable third party control and censorship. If you look at microsoft's censorship of bing in china for example, they are more than willing to bend the knee if it means they can get ahead.
In 2013, when the same party was in power, SERPRO was tasked with replacing Microsoft in key aspects, such as government email (which was handled by Outlook Server at that time) and operating systems.
The main reason was fear of espionage. So, in reality, we are more afraid of the US spying on us than random internet dissidents.
Earlier quoted context omitted.
These are generally government CAs, so, typically the situation is Microsoft sold the government Windows, and as part of that deal (at least tacitly) agreed to the CA being trusted, and so every system that's trusting these certificates is a Windows PC anyway, running Edge because the whole point was the government will only use Windows and pays Microsoft $$$. Why bake it into everybody else's Windows? If you make sa…
what's the state's interest in having their CA built into windows?
It gets worse. ICP-Brasil, the AC mentioned in the bug reports, the the government run agency responsible for all things related to digital signatures. Digitally signing a contract, a deed, accessing tax returns…
Earlier quoted context omitted.
Yes; malice is indefensible no matter the circumstances, mistakes may be defensible under certain circumstances or with certain responses by the mistakee.
as a brazilian i’m not sure if I’d prefer it to be malice or incompetence