4 ms·
On thinking about it a little more, I guess when you visit a site with SSL, and that site subsequently sends you its public key, which in turns allows you to se
by tarkin2 17y ago
On thinking about it a little more, I guess when you visit a site with SSL, and that site subsequently sends you its public key, which in turns allows you to send it encrypted data, Firefox will only accept public keys signed (authorised) by those companies in your root certificate list.
This means if, unknown to you, CINIC impersonates a domain which uses SSL, and you visit that domain and assume your SSL connection will be safe from prying Chinese officials, you're incorrect. Incorrect because Chinese officials could have created that bogus SSL certificate, and it would be accepted by Firefox because Firefox now accept CINIC as a root authority.
Any confirmation, in case I'm spreading inaccuracies, would be appreciated.
- AndrewHampton 17y agoDoes anyone know if the Chinese gov't could use information gathered by CNNIC for issuing the certificate to decrypt traffic it intercepts encrypted by the public key?
- tarkin2 17y agoCNNIC would only ever see the public key, and you can't decrypt encrypted data using the public key--you must use the private key to decrypt the data, something CNNIC would not see--so no. As mentioned, CNNIC's inclusion only allows a Man In The Middle Attack. That is, CNNIC, i.e. the Chinese government, pretending to be a site they're not, and using their status as a Firefox (and other) -authorised root certificate provider to further trick the user into accepting the bogus SSL certificate as originating from the hijacked domain.
- AndrewHampton 17y agoOK, thanks for the explanation.
- __david__ 17y agoThis is indeed the case. The weakness of our current SSL infrastructure is that any CA can sign any site's cert. So the more trusted CAs you have, the wider the attack vector is--all it takes is one rogue CA (or more likely, one CA with weak security) and you can be effectively man-in-the-middled.