3 ms·

If a publicly-trusted CA would issue MitM certificates for WiFi operators (specifically for domains that the WiFi operator doesn't own), they'd be out of busine

by pfg 10y ago

If a publicly-trusted CA would issue MitM certificates for WiFi operators (specifically for domains that the WiFi operator doesn't own), they'd be out of business in a heartbeat. That would be a severe violation of Baseline Requirements and various root program policies, and no browser vendor would continue trusting such a CA. Both HPKP and other pinning technologies included in e.g. Chrome would make this easily detectable. This scenario might be plausible for targeted attacks by nation states, but not for something as simple as public WiFi.

mtgx 10y ago
Ok, so you think BlueCoat will be out of business because of this? Surveillance and censorship is BlueCoat's business, and now they're a CA. https://news.ycombinator.com/item?id=11781915 https://news.ycombinator.com/item?id=11781915
- pfg 10y ago
  The question here isn't whether BlueCoat would go out of business, but rather Symantec. I don't like Symantec, nor do I like BlueCoat. That being said, we have no evidence that this certificate was used for misissuance. Symantec claims that BlueCoat never had access to the private key. The certificate was disclosed to Mozilla's root program. I have no idea why Symantec would agree to sign a certificate for an organization like BlueCoat - the PR damage has to be devastating. It would make even less sense for them to sign such a certificate to allow BlueCoat to use it with their MitM devices, because something like that is more or less guaranteed to be detected sooner or later, with HPKP and other pinning technologies. They would essentially kill their CA business, and I doubt any amount of money BlueCoat would be willing to pay would cover their entire CA business profits.
throwaway7767 10y ago
> If a publicly-trusted CA would issue MitM certificates for WiFi operators (specifically for domains that the WiFi operator doesn't own), they'd be out of business in a heartbeat. The fact that Trustwave still has their CA certificate proves you wrong. They provided a sub-CA to one of their customers for the purpose of MITM. They got a slap on the wrist, gave a promist that they'd never do it again, and that was it. Your browser still trusts this company that has demonstrated that they are perfectly willing to compromise the safety of the whole CA system for a sale. It wasn't WiFi, but that's not really a relevant detail here. Selling certs for the purpose of MITM is.
- pfg 10y ago
  This happened in 2012 and caused a number of changes to various root programs[1]. Mozilla, for example, is now forcing CAs to disclose any subCAs they sign. This is also from a time when the Baseline Requirements in its current form were not yet part of e.g. Mozilla's root policy (that only happened later in 2012). It also predates HPKP (and possibly the pinning mechanism Chrome used before that for their own domains, I'm not sure of the timeline). A lot has changed since that incident, and I have no doubt that the reaction to something like this would be different today, especially if a CA does this knowingly. [1]: https://wiki.mozilla.org/CA:Communications#February_17.2C_2012 https://wiki.mozilla.org/CA:Communications#February_17.2C_20...

by pfg 10y ago

mtgx 10y ago

Ok, so you think BlueCoat will be out of business because of this? Surveillance and censorship is BlueCoat's business, and now they're a CA. https://news.ycombinator.com/item?id=11781915 https://news.ycombinator.com/item?id=11781915

pfg 10y ago
The question here isn't whether BlueCoat would go out of business, but rather Symantec. I don't like Symantec, nor do I like BlueCoat. That being said, we have no evidence that this certificate was used for misissuance. Symantec claims that BlueCoat never had access to the private key. The certificate was disclosed to Mozilla's root program. I have no idea why Symantec would agree to sign a certificate for an organization like BlueCoat - the PR damage has to be devastating. It would make even less sense for them to sign such a certificate to allow BlueCoat to use it with their MitM devices, because something like that is more or less guaranteed to be detected sooner or later, with HPKP and other pinning technologies. They would essentially kill their CA business, and I doubt any amount of money BlueCoat would be willing to pay would cover their entire CA business profits.

throwaway7767 10y ago

> If a publicly-trusted CA would issue MitM certificates for WiFi operators (specifically for domains that the WiFi operator doesn't own), they'd be out of business in a heartbeat. The fact that Trustwave still has their CA certificate proves you wrong. They provided a sub-CA to one of their customers for the purpose of MITM. They got a slap on the wrist, gave a promist that they'd never do it again, and that was it. Your browser still trusts this company that has demonstrated that they are perfectly willing to compromise the safety of the whole CA system for a sale. It wasn't WiFi, but that's not really a relevant detail here. Selling certs for the purpose of MITM is.

pfg 10y ago
This happened in 2012 and caused a number of changes to various root programs[1]. Mozilla, for example, is now forcing CAs to disclose any subCAs they sign. This is also from a time when the Baseline Requirements in its current form were not yet part of e.g. Mozilla's root policy (that only happened later in 2012). It also predates HPKP (and possibly the pinning mechanism Chrome used before that for their own domains, I'm not sure of the timeline). A lot has changed since that incident, and I have no doubt that the reaction to something like this would be different today, especially if a CA does this knowingly. [1]: https://wiki.mozilla.org/CA:Communications#February_17.2C_2012 https://wiki.mozilla.org/CA:Communications#February_17.2C_20...