Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows SSL Interception Gone Wild

facebook.com

Post reply on HN
Print view View original

41–50 of 137 posts

Re: Windows SSL Interception Gone Wild

#41

Post by Buge »

jgwest wrote: post #22

I think it's interesting that this BADWARE install was found more or less accidentally... apparently by some tech dude noticing that his bank login presented a Silverfish-issued CA cert. Shouldn't the possiblity have been forseen and addressed beforehand? Perhaps by... (1) Anti-virus / anti-malware makers. Does this software not notify the user when strange CA certs are put into a system's root certificate storage? I…

I found it by myself several weeks before all this news came out.

I got my new Lenovo Y50, visited my own website with it and decided to see how my https cert looked. I got quite scared when I saw I was being MITMed but I googled it and there were already a ton of forum posts saying it's just stuff bundled with Lenovo. So I uninstalled it.

Re: Windows SSL Interception Gone Wild

#42

Post by dredmorbius »

zevyoura wrote: post #28
ams6110 wrote: post #20

we see several reasons to be concerned about this practice in the case of Superfish and others. Chief among those is privacy—the Superfish software can see all of the computer user's activity, including banking, email and Facebook traffic. Never mind that Facebook sees all the computer user's Facebook traffic, and cross-indexes it with every other bit of data gleaned from their vast graph and uses it for profit.

Yes, and they do all that with the user's consent.

Um, really? How informed is that consent?

What of sites that unilaterally change rules retroactively? Or fail to provide reasonable alternatives?

Facebook does all of the above.

To an extent that I don't trust it, and don't use it.

But there are plenty of other services which wave the "but you consented!" flag. Google comes to mind, and I've had my set of issues with them as well.

Re: Windows SSL Interception Gone Wild

#43

Post by shpx »

aosmith wrote: post #40
scrollaway wrote: post #31

Earlier quoted context omitted.

The superfish issue is why you run linux? You could've given the world a bit of a heads up on it, don't you think?

No, if you wipe the hd and reinstall it's not an issue. I run linux because I like it. Stuff like this doesn't happen with mainstream distros.

I guess you haven't heard of amazon+ubuntu? This is just a side effect of maximizing profits, and it happens to anyone making a profit, unless they're idealistic enough.

Re: Windows SSL Interception Gone Wild

#44

Post by dredmorbius »

mentat wrote: post #4
nugget wrote: post #2

Just to be clear, Facebook and Google hate any software that allows users to modify content within their walled gardens (whether that's an adblock, ad injector, or other). These companies want a totally controllable user experience in order to maximize their own user metrics and monetization. My fear is that these companies will use this Superfish debacle to attack and restrict the ability for users to download legit…

I'm not sure why a normal user would ever need to add CAs to their root store. Can you clarify?

Adding (or removing) CAs is a fully legitimate activity.

Your own site, work, or vendor / client sites could be added.

Or you could want to remove a Comodo (or Honest Achmed's Used Cars and Certificates).

http://www.livehacking.com/2011/04/25/honest-achmeds-used-ca...

https://bugzilla.mozilla.org/show_bug.cgi?id=647959

Just because your OS / browser vendor "trusts" a cert doesn't mean you should.

Re: Windows SSL Interception Gone Wild

#45

Post by Buge »

mentat wrote: post #4
nugget wrote: post #2

Just to be clear, Facebook and Google hate any software that allows users to modify content within their walled gardens (whether that's an adblock, ad injector, or other). These companies want a totally controllable user experience in order to maximize their own user metrics and monetization. My fear is that these companies will use this Superfish debacle to attack and restrict the ability for users to download legit…

I'm not sure why a normal user would ever need to add CAs to their root store. Can you clarify?

I add CAs to my root store so that I can view my https traffic using fiddler.

Also if you want to use http://www.cacert.org/ you need to add their cert.

Re: Windows SSL Interception Gone Wild

#46

Post by practicalpants »

logn wrote: post #32

Browser plugins can read SSL pages no problem. So why did Superfish not just present itself like a browser plugin? Then it's just normal bloatware and probably pulls in the same profit. Some people might uninstall it is the only reason I can think why they didn't go this route. They could have pre-bundled Chrome and FF to avoid having users ok the plugin installation.

> So why did Superfish not just present itself like a browser plugin

They did this for years, actually. They paid add-on developers to bundle their shopping app with the developer's app. I remember this going on ~2010/2011 at least.

People were not happy about it to say the least.

Re: Windows SSL Interception Gone Wild

#47

Post by GauntletWizard »

jgwest wrote: post #22

I think it's interesting that this BADWARE install was found more or less accidentally... apparently by some tech dude noticing that his bank login presented a Silverfish-issued CA cert. Shouldn't the possiblity have been forseen and addressed beforehand? Perhaps by... (1) Anti-virus / anti-malware makers. Does this software not notify the user when strange CA certs are put into a system's root certificate storage? I…

(3) Google; Chrome has a rather sophisticated mechanism for detecting MITM attacks, in that it's distributed with pinned certs for several Google properties, and phones home with reports of errors it receives. This is how the DigiNotar leak[1] was discovered.

Perhaps because it was persistent and on the TCP stack level the phonehomes never succeeded? The retry logic should be robust enough to try to deliver the fraud list anyway, even if it will only accept that it has been delivered after a secured connection is restored.

[1] http://en.wikipedia.org/wiki/DigiNotar#Issuance_of_fraudulen...

Re: Windows SSL Interception Gone Wild

#48

Post by nothrabannosir »

GauntletWizard wrote: post #47
jgwest wrote: post #22

I think it's interesting that this BADWARE install was found more or less accidentally... apparently by some tech dude noticing that his bank login presented a Silverfish-issued CA cert. Shouldn't the possiblity have been forseen and addressed beforehand? Perhaps by... (1) Anti-virus / anti-malware makers. Does this software not notify the user when strange CA certs are put into a system's root certificate storage? I…

(3) Google; Chrome has a rather sophisticated mechanism for detecting MITM attacks, in that it's distributed with pinned certs for several Google properties, and phones home with reports of errors it receives. This is how the DigiNotar leak[1] was discovered. Perhaps because it was persistent and on the TCP stack level the phonehomes never succeeded? The retry logic should be robust enough to try to deliver the fraud…

That list is public; if you are in the business of writing these proxies anyway, fetching that list and using it as do-not-mitm exceptions is not a stretch. Which, unfortunately, defeats this nice side-effect of certificate pinning. People could have learned from the Diginotar mistake (being: mitm'ing ssl-pinned certs).

Re: Windows SSL Interception Gone Wild

#49

Post by pilif »

GauntletWizard wrote: post #47
jgwest wrote: post #22

I think it's interesting that this BADWARE install was found more or less accidentally... apparently by some tech dude noticing that his bank login presented a Silverfish-issued CA cert. Shouldn't the possiblity have been forseen and addressed beforehand? Perhaps by... (1) Anti-virus / anti-malware makers. Does this software not notify the user when strange CA certs are put into a system's root certificate storage? I…

(3) Google; Chrome has a rather sophisticated mechanism for detecting MITM attacks, in that it's distributed with pinned certs for several Google properties, and phones home with reports of errors it receives. This is how the DigiNotar leak[1] was discovered. Perhaps because it was persistent and on the TCP stack level the phonehomes never succeeded? The retry logic should be robust enough to try to deliver the fraud…

Chrome does not warn if the non-official root certificate is custom installed on the local machine. It needs to do this because of the various corporate web filters and anti virus tools that MITM connections too.

Maybe this is a practice that needs to stop. Malware scanners can scan on the local machine after the browser has decrypted the communication and web filtering, I think, is nothing but a sign of mistrust against the users.

Post reply on HN