4 ms·
Mozilla Debates Whether to Trust Chinese CA
- andrewcooke 17y agois there any kind of technical solution that would help flag abuse? for example, something like the way ssh records and flags keys, so that you are warned if the certificate you have received, while validated, has changed from what you had received previously? there would be false positives on expiry, but perhaps they could be flagged as such anyway. would this help, or am i missing something? obviously it's only going to work if interception is the exception rather than the rule. and it only addresses eavesdropping - it doesn't do anything to stop china implementing some kind of firewall that refuses ssh connections for non-local certs, for example.
- onedognight 17y agoYes, frankly what you are proposing is the only viable solution I can see. The Chinese government can now man-in-the-middle any SSL connection from a browser that has their cert. Be it at a café in the U.S. (by having an agent sitting along side you) or any connection that goes through a router they control. In case you didn't know, this has already been the case for the U.S. government, the Taiwanese government, etc. because SSL root certs (at least the ones in your browser today) know no boundaries. SSH is secure because presumably you know when a certificate should be changing and are suspicious otherwise. Today's browsers don't warn you when a the root cert for a domain changes, but they could.
- wmf 17y agohttp://www.cs.cmu.edu/~perspectives/ http://www.cs.cmu.edu/~perspectives/ should detect and warn about SSL MITMs.
- andrewcooke 17y agocute - same idea but replaces knowledge over time with knowledge over network paths. requires a lot more infrastructure, but removes the "first visit" vulnerability.
- raganwald 17y agoI certainly don't trust any CA that has even the appearance of being tied to the Chinese government.
- mbreese 17y agoThat CA is already included with Windows and Mac OSX. When you look at the list, it's quite impressive exactly how many root CA's are actually trusted. For example, the DOD is also trusted... For what it's worth, it's not in the default ubuntu list, but you are using Firefox, it's in there...
- illumin8 17y agoSeriously, wtf? DoD managed to get a root CA in our browsers? Surely this should not be allowed by any sane corporation, and especially the Mozilla Foundation.
- kijuhygfh 17y agoYou would prefer that .mil sites were secured by Versign?
- illumin8 17y ago.mil can and should create their own Certificate Authority and install their own root cert on .mil computers. Just don't install their root cert on mine. I'm going to be checking mine now and removing DoD from there. If any other government's military got a root cert installed, you better believe we'd be hearing about it.
- fragmede 17y agoI'd prefer that the DOD didn't have the power to sign .com addresses in addition to .mil. Not that it isn't idle paranoia. Verisign's incompetence is secondary. (The whatever that Verisign (I'm guessing) has the ability to sign .mil is not lost on me.))
- deleted 17y ago
- coderdude 17y ago>>To see why this is worrisome, [...] giving the Chinese government free run of the citizen's email archive. It sounds a bit silly when you put it into words and read it.
- baguasquirrel 17y agoThat begs the question... if there is a CA on there I do not trust, how do I remove it? In Chrome I'm having trouble finding the list of root CAs.
- agl 17y agoChrome uses the system certificate store. On Windows, that means it's the same one as IE, so you can probably Google for instructions. I'm not familiar with Mac. On Linux, it uses the system NSS library. NSS is built with a set of root CAs so you would have to see what your distribution chose to include.
- tlrobinson 17y agoOS X has "keychain" which can be viewed and modified from the Keychain Access app.