4 ms·

Would Microsoft accept a Google-signed certificate? Would Microsoft pre-install such certificates by default?

by windsurfer 17y ago

dangrossman 17y ago
Is there some reason Microsoft would not want to accept a Google signed certificate?
- tptacek 17y ago
  Is there some reason Microsoft would want to accept a Google root certificate?
  - ars 17y ago
    Regulatory or consumer pressure. The desire to not have the appearance of anti-competitive actions.
    - tptacek 17y ago
      ... are fuzzy arguments that will be torpedoed by any weal security argument Microsoft deploys against them. Turn this over on its head. What about Mozilla accepting a Microsoft-run CA?
      - blasdel 17y ago
        I really hope they would -- it'd be extremely nice for vanilla Windows Server installs to be able to provision themselves a default certificate. Of course, Mozilla are the asshats that innovated the draconian dialog maze for self-signed certificates, and as such have made it impossible to ship appliances with HTTPS web interfaces. I hope their heads fall off. Don't you really want WiFi access point config pages to be HTTPS-only?
        tptacek 17y ago
        In my experience, Mozilla comes in for the harshest criticism from the people who understand TLS the least.
        cpach 17y ago
        What's the argument? That Mozilla makes it too hard to use self-signed certs?
        tptacek 17y ago
        Yep.
        windsurfer 17y ago
        I think it's great that Mozilla made it difficult to use self-signed certs. Most people don't use them correctly, and making self-signed essentially off limits to people is a great increase in security. You should try using ettercap. It's surprisingly easy to intercept all traffic going to and from a self-signed site.
        ars 17y ago
        It's easy to use ettercap to mount a man-in-the-middle attack? Self-signed certs are only vulnerable to mitm attacks, but don't most network topologies make doing that pretty hard?
        tptacek 17y ago
        No. Anyone who can see a DNS query can hijack traffic.
  - deleted 17y ago
    [deleted]

Would Microsoft accept a Google-signed certificate? Would Microsoft pre-install such certificates by default?

dangrossman 17y ago

Is there some reason Microsoft would not want to accept a Google signed certificate?

tptacek 17y ago
Is there some reason Microsoft would want to accept a Google root certificate?
- ars 17y ago
  Regulatory or consumer pressure. The desire to not have the appearance of anti-competitive actions.
  - tptacek 17y ago
    ... are fuzzy arguments that will be torpedoed by any weal security argument Microsoft deploys against them. Turn this over on its head. What about Mozilla accepting a Microsoft-run CA?
    - blasdel 17y ago
      I really hope they would -- it'd be extremely nice for vanilla Windows Server installs to be able to provision themselves a default certificate. Of course, Mozilla are the asshats that innovated the draconian dialog maze for self-signed certificates, and as such have made it impossible to ship appliances with HTTPS web interfaces. I hope their heads fall off. Don't you really want WiFi access point config pages to be HTTPS-only?
      - tptacek 17y ago
        In my experience, Mozilla comes in for the harshest criticism from the people who understand TLS the least.
        cpach 17y ago
        What's the argument? That Mozilla makes it too hard to use self-signed certs?
        tptacek 17y ago
        Yep.
      - windsurfer 17y ago
        I think it's great that Mozilla made it difficult to use self-signed certs. Most people don't use them correctly, and making self-signed essentially off limits to people is a great increase in security. You should try using ettercap. It's surprisingly easy to intercept all traffic going to and from a self-signed site.
        ars 17y ago
        It's easy to use ettercap to mount a man-in-the-middle attack? Self-signed certs are only vulnerable to mitm attacks, but don't most network topologies make doing that pretty hard?
        tptacek 17y ago
        No. Anyone who can see a DNS query can hijack traffic.
- deleted 17y ago
  [deleted]