6 ms·

What do you do? You immediately reach out to Apple, Google, Facebook, Twitter, Box, Dropbox, Tumblr, and any other popular platform which has mobile apps. You

What do you do? You immediately reach out to Apple, Google, Facebook, Twitter, Box, Dropbox, Tumblr, and any other popular platform which has mobile apps. You ask, or down-right demand they implement certificate pinning in their apps so they will fail when middled with the government provided certificate. This will in turn break access to those platforms via mobile apps which will result in very real and direct impact to citizens who will then hopefully wake up and pressure the government to roll-back the program or at least put exceptions in place. You continue this strategy with banks, etc., until it becomes clear to the government that this plan will not work. Note that cert pinning for mobile and desktop apps should have happened long ago & this might be the perfect opportunity to drive it to happen.

RKearney 11y ago
Certificate pinning does not work with certificates that are installed in the devices trusted certificate store.
- infinity0 11y ago
  You are confused. This is exactly what pinning defends against.
  - cbr 11y ago
    Sorry, no: Chrome does not perform pin validation when the certificate chain chains up to a private trust anchor. A key result of this policy is that private trust anchors can be used to proxy (or MITM) connections, even to pinned sites. -- https://www.chromium.org/Home/chromium-security/security-faq#TOC-How-does-key-pinning-interact-with-local-proxies-and-filters- https://www.chromium.org/Home/chromium-security/security-faq...
    - deleted 11y ago
      [deleted]
    - mil0 11y ago
      How would the telco get their Private Trust Anchor into the certificate store ? More social engineering, i suppose. At the app level though, a chain resolution like what you describe is not required.
      - maaku 11y ago
        I'll give you a hint: they run customs.
        blazespin 11y ago
        Wuh? Why not just ask the user to insert the cert?
        therein 11y ago
        They COULD do that but they almost certainly aren't doing that. That's a tedious task that requires a lot of time and technically competent employees. Also we are talking about apps implementing certificate pinning. Not reading from the OS store etc., and therefore, I don't see Kazakhstan reverse engineering and patching executables.
      - nathan_f77 11y ago
        They will be telling citizens to install a "national security certificate". After they implement this, you won't be able to access the internet without it.
    - tremon 11y ago
      How does "Chrome does not perform pin validation" translate to "This is not what pinning defends against"? The fact that Chrome ships with a broken implementation does not imply the concept is broken.
      - tripzilch 11y ago
        You are right of course, but there are apparently a whole lot of people of the opinion that since Chrome was (one of the?) first apps implementing some sort of pinning, that this is de facto what certificate pinning "is". I don't really agree with that, but it's IMO more useful to acknowledge the confusion, than having an argument about whether Chrome really does pinning or even gets to de facto define pinning or not, since this isn't even about Chrome :)
        tremon 11y ago
        I get your point. The notion of designating a broken implementation as "the standard" makes me queasy, ever since IE6 happened. But still, I would have much preferred if the GP would have started their comment with "yes, but" instead of "sorry, no". That would have made the distinction much clearer.
    - mtgx 11y ago
      Why the hell doesn't Chrome have its own root cert store by now anyway? I can't believe they are leaving such an important trust piece to Microsoft's Windows...
- FiloSottile 11y ago
  He's talking about mobile apps pinning the backend certificates, not HPKP.
- patcheudor 11y ago
  Certificate pinning is absolutely targeted at stopping the use of rogue root CA's installed in devices. OWASP does a pretty good job of covering the topic. https://www.owasp.org/index.php/Certificate_and_Public_Key_Pinning https://www.owasp.org/index.php/Certificate_and_Public_Key_P...
  - zurn 11y ago
    You just linked to 20 screenfuls of text that explain pinning in general, without a single mention of "rogue". The fact is that pinning as implemented in Chrome exempts installed CA's from pinning checks because they want to allow administrator-mandated MITM - apparently "market requirement" because it's a common practice in schools and workplaces in some countries that lack reasonable communications privacy legislation.
    - antocv 11y ago
      Lol, you already see where this is going "market requirements dictates backdoors everywhere!"
    - Excavator 11y ago
      Of course a system misbehaves if you use an (intentionally) broken application. That's a Google Chrome issue and not an issue with pinning.
      - zurn 11y ago
        You might have a point if Chrome hadn't been the first browser to implement pinning, therefore defining the concept in web context to a large extent. You may argue that this is is broken behaviour, but that's what pinning currently is in browsers. Seems it's this way in Firefox too ("pinning not enforced if the trust anchor is a user inserted CA, default" - https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinning https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinn...)
- HappyTypist 11y ago
  I don't think you understand how certificate pinning works then. Many apps right now allow local trust stores, but with this announcement I bet that'll change.
- KirinDave 11y ago
  Apps can certificate pin in 2 ways. One, they can directly inspect the certificate fingerprint and pin to a specific fingerprint (I chose this method for Level Money's product). The other option is to examine and pin the signing certificate. This is more code and more prone to error, but makes your connection slighty more robus in the face of a compromised certificate. And yes, both techniques work even if a cert in your root store has another certificate. Applications can simply refuse to function, but this has to be done on an ad hoc basis.
asymmetric 11y ago
Down-right demand? With what authority? It sounds like you're confusing these corporations for governments, as if they had to enforce your human rights..
- patcheudor 11y ago
  The authority of the free market. Did web PKI develop because of governments? No. In fact, quite the contrary. Similarly, if consumers are educated and aware of the weaknesses of current cryptography controls in light of new threats such as governments requiring the installation of their own root CA so they can middle the connection, maybe they'll drive demand for better controls, controls which already exist.
  - Beltiras 11y ago
    Consumers want their kitten videos. They would only view the dialog as an error message, something to get rid of.
  - pmlnr 11y ago
    > The authority of the free market That only works in some areas of the world, where a, there is a somewhat free market; b, the free market idea exists in the first place. As always, like in Perl, there are other ways of doing things; free market is not a universal law.
- sukulaku 11y ago
  Are you suggesting governments "have to" "enforce your human rights"? Wouldn't that imply not monitoring everyone?
- purplerabbit 11y ago
  Authority is a self-made concept, and governments are just a type of corporation. Of course neither "has" to enforce your human rights, but if these corporations stood up for the people it would be good for everyone involved.
- mentat 11y ago

RKearney 11y ago

Certificate pinning does not work with certificates that are installed in the devices trusted certificate store.

infinity0 11y ago
You are confused. This is exactly what pinning defends against.
- cbr 11y ago
  Sorry, no: Chrome does not perform pin validation when the certificate chain chains up to a private trust anchor. A key result of this policy is that private trust anchors can be used to proxy (or MITM) connections, even to pinned sites. -- https://www.chromium.org/Home/chromium-security/security-faq#TOC-How-does-key-pinning-interact-with-local-proxies-and-filters- https://www.chromium.org/Home/chromium-security/security-faq...
  - deleted 11y ago
    [deleted]
  - mil0 11y ago
    How would the telco get their Private Trust Anchor into the certificate store ? More social engineering, i suppose. At the app level though, a chain resolution like what you describe is not required.
    - maaku 11y ago
      I'll give you a hint: they run customs.
      - blazespin 11y ago
        Wuh? Why not just ask the user to insert the cert?
      - therein 11y ago
        They COULD do that but they almost certainly aren't doing that. That's a tedious task that requires a lot of time and technically competent employees. Also we are talking about apps implementing certificate pinning. Not reading from the OS store etc., and therefore, I don't see Kazakhstan reverse engineering and patching executables.
    - nathan_f77 11y ago
      They will be telling citizens to install a "national security certificate". After they implement this, you won't be able to access the internet without it.
  - tremon 11y ago
    How does "Chrome does not perform pin validation" translate to "This is not what pinning defends against"? The fact that Chrome ships with a broken implementation does not imply the concept is broken.
    - tripzilch 11y ago
      You are right of course, but there are apparently a whole lot of people of the opinion that since Chrome was (one of the?) first apps implementing some sort of pinning, that this is de facto what certificate pinning "is". I don't really agree with that, but it's IMO more useful to acknowledge the confusion, than having an argument about whether Chrome really does pinning or even gets to de facto define pinning or not, since this isn't even about Chrome :)
      - tremon 11y ago
        I get your point. The notion of designating a broken implementation as "the standard" makes me queasy, ever since IE6 happened. But still, I would have much preferred if the GP would have started their comment with "yes, but" instead of "sorry, no". That would have made the distinction much clearer.
  - mtgx 11y ago
    Why the hell doesn't Chrome have its own root cert store by now anyway? I can't believe they are leaving such an important trust piece to Microsoft's Windows...
FiloSottile 11y ago
He's talking about mobile apps pinning the backend certificates, not HPKP.
patcheudor 11y ago
Certificate pinning is absolutely targeted at stopping the use of rogue root CA's installed in devices. OWASP does a pretty good job of covering the topic. https://www.owasp.org/index.php/Certificate_and_Public_Key_Pinning https://www.owasp.org/index.php/Certificate_and_Public_Key_P...
- zurn 11y ago
  You just linked to 20 screenfuls of text that explain pinning in general, without a single mention of "rogue". The fact is that pinning as implemented in Chrome exempts installed CA's from pinning checks because they want to allow administrator-mandated MITM - apparently "market requirement" because it's a common practice in schools and workplaces in some countries that lack reasonable communications privacy legislation.
  - antocv 11y ago
    Lol, you already see where this is going "market requirements dictates backdoors everywhere!"
  - Excavator 11y ago
    Of course a system misbehaves if you use an (intentionally) broken application. That's a Google Chrome issue and not an issue with pinning.
    - zurn 11y ago
      You might have a point if Chrome hadn't been the first browser to implement pinning, therefore defining the concept in web context to a large extent. You may argue that this is is broken behaviour, but that's what pinning currently is in browsers. Seems it's this way in Firefox too ("pinning not enforced if the trust anchor is a user inserted CA, default" - https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinning https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinn...)
HappyTypist 11y ago
I don't think you understand how certificate pinning works then. Many apps right now allow local trust stores, but with this announcement I bet that'll change.
KirinDave 11y ago
Apps can certificate pin in 2 ways. One, they can directly inspect the certificate fingerprint and pin to a specific fingerprint (I chose this method for Level Money's product). The other option is to examine and pin the signing certificate. This is more code and more prone to error, but makes your connection slighty more robus in the face of a compromised certificate. And yes, both techniques work even if a cert in your root store has another certificate. Applications can simply refuse to function, but this has to be done on an ad hoc basis.

asymmetric 11y ago

Down-right demand? With what authority? It sounds like you're confusing these corporations for governments, as if they had to enforce your human rights..

patcheudor 11y ago
The authority of the free market. Did web PKI develop because of governments? No. In fact, quite the contrary. Similarly, if consumers are educated and aware of the weaknesses of current cryptography controls in light of new threats such as governments requiring the installation of their own root CA so they can middle the connection, maybe they'll drive demand for better controls, controls which already exist.
- Beltiras 11y ago
  Consumers want their kitten videos. They would only view the dialog as an error message, something to get rid of.
- pmlnr 11y ago
  > The authority of the free market That only works in some areas of the world, where a, there is a somewhat free market; b, the free market idea exists in the first place. As always, like in Perl, there are other ways of doing things; free market is not a universal law.
sukulaku 11y ago
Are you suggesting governments "have to" "enforce your human rights"? Wouldn't that imply not monitoring everyone?
purplerabbit 11y ago
Authority is a self-made concept, and governments are just a type of corporation. Of course neither "has" to enforce your human rights, but if these corporations stood up for the people it would be good for everyone involved.
mentat 11y ago