4 ms·

I certainly don't trust any CA that has even the appearance of being tied to the Chinese government.

mbreese 17y ago
That CA is already included with Windows and Mac OSX. When you look at the list, it's quite impressive exactly how many root CA's are actually trusted. For example, the DOD is also trusted... For what it's worth, it's not in the default ubuntu list, but you are using Firefox, it's in there...
- illumin8 17y ago
  Seriously, wtf? DoD managed to get a root CA in our browsers? Surely this should not be allowed by any sane corporation, and especially the Mozilla Foundation.
  - kijuhygfh 17y ago
    You would prefer that .mil sites were secured by Versign?
    - illumin8 17y ago
      .mil can and should create their own Certificate Authority and install their own root cert on .mil computers. Just don't install their root cert on mine. I'm going to be checking mine now and removing DoD from there. If any other government's military got a root cert installed, you better believe we'd be hearing about it.
    - fragmede 17y ago
      I'd prefer that the DOD didn't have the power to sign .com addresses in addition to .mil. Not that it isn't idle paranoia. Verisign's incompetence is secondary. (The whatever that Verisign (I'm guessing) has the ability to sign .mil is not lost on me.))
  - deleted 17y ago
    [deleted]
- zabuni 17y ago
  Really, I don't believe they install dod root certificates by default. In fact, Firefox has an addon to install the certificates and keep them up to date: https://addons.mozilla.org/en-US/firefox/addon/3182 https://addons.mozilla.org/en-US/firefox/addon/3182 One of the things I've had to do when dealing with DoD networks on the client side is install the root certificates from a site, like: http://dodpki.c3pki.chamb.disa.mil/rootca.html http://dodpki.c3pki.chamb.disa.mil/rootca.html
deleted 17y ago
[deleted]
- kijuhygfh 17y ago
  Funny that we aren't allowed encryption because we might be anti-government 'terrorists' and the Chinese aren't allowed it because they might be cheating on tax. but then - I remember the days when we were oil rich capitalists and the Russians nationalised banks and sent people to secret camps without trial.
  - houseabsolute 17y ago
    Who is the "we" who is not allowed to use encryption?
    - est 17y ago
      perhaps the encryption export limit law?
  - CWuestefeld 17y ago
    Haven't we always had such a dichotomy? For example, the American left chastises the right for being greedy, etc., and that there are higher pursuits than the material. Yet it's the left that thinks that money is so important that they must take it from others to support one's lack of it.
- justin_hancock 17y ago
  On point 1 .US domains have to prove that they are being registered by companies or citizens in the US, at least in my experience anyway. Lot's of countries control registration of domains, it's a self interest thing it's not unique to China. I agree with you on point 2 and posssibly 3. China tends to act unilaterally, bi-/multi laterally when it suits, see recent climate change talks.
- Nelson69 17y ago
  They're going to intercept the key exchange and then verify the keys in real time? And then make an allow or block decision? This is very hard, you ultimately have to do deep packet inspection on everything to do this. (think of all the "starttls" protocols..) And SSH keys aren't part of a PKI... The best IPS products in the world are way way way off from that. As I understand the current "great firewall" it simply won't resolve sites they restrict access to, mostly social networking sites were my experience while I was there. FWIW, when they censor CNN they just black the screen out, they don't exactly hide what they're doing. Personally, I think you're right that this is mostly about money. I don't like the fact that it could be about other things, I really don't like the fact that they could just turn off the internet for the whole country, I don't see it being possible to restrict traffic like you suggest though. A lot of businesses do business there and have VPNs to China... They won't just hand the keys over and what does China do when they change them? Back to the CA though, do you really suffer if you just block access to and from .cn? I've had firewall policies over the years where I've turned large chunks of countries off and I can't say I feel like it's had much of an adverse affect on things. When I'm ready to do business directly with China then I can but until then it doesn't seem like it hurts much.

That CA is already included with Windows and Mac OSX. When you look at the list, it's quite impressive exactly how many root CA's are actually trusted. For example, the DOD is also trusted... For what it's worth, it's not in the default ubuntu list, but you are using Firefox, it's in there...

illumin8 17y ago
Seriously, wtf? DoD managed to get a root CA in our browsers? Surely this should not be allowed by any sane corporation, and especially the Mozilla Foundation.
- kijuhygfh 17y ago
  You would prefer that .mil sites were secured by Versign?
  - illumin8 17y ago
    .mil can and should create their own Certificate Authority and install their own root cert on .mil computers. Just don't install their root cert on mine. I'm going to be checking mine now and removing DoD from there. If any other government's military got a root cert installed, you better believe we'd be hearing about it.
  - fragmede 17y ago
    I'd prefer that the DOD didn't have the power to sign .com addresses in addition to .mil. Not that it isn't idle paranoia. Verisign's incompetence is secondary. (The whatever that Verisign (I'm guessing) has the ability to sign .mil is not lost on me.))
- deleted 17y ago
  [deleted]
zabuni 17y ago
Really, I don't believe they install dod root certificates by default. In fact, Firefox has an addon to install the certificates and keep them up to date: https://addons.mozilla.org/en-US/firefox/addon/3182 https://addons.mozilla.org/en-US/firefox/addon/3182 One of the things I've had to do when dealing with DoD networks on the client side is install the root certificates from a site, like: http://dodpki.c3pki.chamb.disa.mil/rootca.html http://dodpki.c3pki.chamb.disa.mil/rootca.html

deleted 17y ago

[deleted]

kijuhygfh 17y ago
Funny that we aren't allowed encryption because we might be anti-government 'terrorists' and the Chinese aren't allowed it because they might be cheating on tax. but then - I remember the days when we were oil rich capitalists and the Russians nationalised banks and sent people to secret camps without trial.
- houseabsolute 17y ago
  Who is the "we" who is not allowed to use encryption?
  - est 17y ago
    perhaps the encryption export limit law?
- CWuestefeld 17y ago
  Haven't we always had such a dichotomy? For example, the American left chastises the right for being greedy, etc., and that there are higher pursuits than the material. Yet it's the left that thinks that money is so important that they must take it from others to support one's lack of it.
justin_hancock 17y ago
On point 1 .US domains have to prove that they are being registered by companies or citizens in the US, at least in my experience anyway. Lot's of countries control registration of domains, it's a self interest thing it's not unique to China. I agree with you on point 2 and posssibly 3. China tends to act unilaterally, bi-/multi laterally when it suits, see recent climate change talks.
Nelson69 17y ago
They're going to intercept the key exchange and then verify the keys in real time? And then make an allow or block decision? This is very hard, you ultimately have to do deep packet inspection on everything to do this. (think of all the "starttls" protocols..) And SSH keys aren't part of a PKI... The best IPS products in the world are way way way off from that. As I understand the current "great firewall" it simply won't resolve sites they restrict access to, mostly social networking sites were my experience while I was there. FWIW, when they censor CNN they just black the screen out, they don't exactly hide what they're doing. Personally, I think you're right that this is mostly about money. I don't like the fact that it could be about other things, I really don't like the fact that they could just turn off the internet for the whole country, I don't see it being possible to restrict traffic like you suggest though. A lot of businesses do business there and have VPNs to China... They won't just hand the keys over and what does China do when they change them? Back to the CA though, do you really suffer if you just block access to and from .cn? I've had firewall policies over the years where I've turned large chunks of countries off and I can't say I feel like it's had much of an adverse affect on things. When I'm ready to do business directly with China then I can but until then it doesn't seem like it hurts much.