3 ms·

Accepting a university cert seems like a terrible idea. I would look into a mobile hotspot or, even better, transferring to a different university. https://sec

by x1798DE 10y ago

Accepting a university cert seems like a terrible idea. I would look into a mobile hotspot or, even better, transferring to a different university. https://security.stackexchange.com/questions/104576/my-college-is-forcing-me-to-install-their-ssl-certificate-how-to-protect-my-pri https://security.stackexchange.com/questions/104576/my-colle...

varenc 10y ago
MIT has its own CA 0_o ca.mit.edu
Piskvorrr 10y ago
Do you trust your university more, or "TÜRKTRUST Elektronik Sertifika"? Who is that, you ask? That is precisely my point. I have no idea, none at all. I do happen to know what my university was (and why it was running its own CA). Yet, this one is doubleplusgood for me. Trust Google, it knows best. (I went to my Android's builtin trusted CA list, this was the very first one - out of a list of about 100, or maybe 200)
- x1798DE 10y ago
  I don't particularly trust either, but: 1. The university is explicitly asking to MITM your traffic, so that's an automatic no-go on any of my devices for me. At least other CAs will be punished if caught. 2. I'm fairly certain these university certs are not subject to certificate transparency, and even if they were, since they are explicitly designed to MITM traffic, I'm not sure that it would raise any red flags if someone other than the university was issuing these certs for inappropriate domains. At least TÜRKTRUST Elektronik Sertifika issuing inappropriate certificates are much more likely to get caught doing anything fishy (with high profile sites, anyway). 3. What you're really trusting is the vendor of whatever security gateway, not the university itself. If you look at the Security.SE thread I linked, there was an actual issue with at least one of the black box vendors. I don't think the other vendors are considerably better. So, all-in-all, I would not accept an MITM certificate on any device that I used for anything personal, full stop.
  - kuschku 10y ago
    You do realize a CA can be limited to be trusted only for some things, yet not for others? For example, many such university certificates are not trusted as CAs for HTTPS?
    - x1798DE 10y ago
      I was talking about MITM certificates. I don't really understand why a university is not just getting a certificate from a CA in the trusted store, but I would have many fewer qualms about something that is not a general MITM certificate. That said, my experience is that generally applications that have a legitimate reason for a limited-use self-signed certificate don't need to be in the general store. For example, it's common to set up OpenVPN with a self-signed certificate, but I've never had to add a certificate to the general store for that - it's always app-specific.

by x1798DE 10y ago

varenc 10y ago

MIT has its own CA 0_o ca.mit.edu

Piskvorrr 10y ago

Do you trust your university more, or "TÜRKTRUST Elektronik Sertifika"? Who is that, you ask? That is precisely my point. I have no idea, none at all. I do happen to know what my university was (and why it was running its own CA). Yet, this one is doubleplusgood for me. Trust Google, it knows best. (I went to my Android's builtin trusted CA list, this was the very first one - out of a list of about 100, or maybe 200)

x1798DE 10y ago
I don't particularly trust either, but: 1. The university is explicitly asking to MITM your traffic, so that's an automatic no-go on any of my devices for me. At least other CAs will be punished if caught. 2. I'm fairly certain these university certs are not subject to certificate transparency, and even if they were, since they are explicitly designed to MITM traffic, I'm not sure that it would raise any red flags if someone other than the university was issuing these certs for inappropriate domains. At least TÜRKTRUST Elektronik Sertifika issuing inappropriate certificates are much more likely to get caught doing anything fishy (with high profile sites, anyway). 3. What you're really trusting is the vendor of whatever security gateway, not the university itself. If you look at the Security.SE thread I linked, there was an actual issue with at least one of the black box vendors. I don't think the other vendors are considerably better. So, all-in-all, I would not accept an MITM certificate on any device that I used for anything personal, full stop.
- kuschku 10y ago
  You do realize a CA can be limited to be trusted only for some things, yet not for others? For example, many such university certificates are not trusted as CAs for HTTPS?
  - x1798DE 10y ago
    I was talking about MITM certificates. I don't really understand why a university is not just getting a certificate from a CA in the trusted store, but I would have many fewer qualms about something that is not a general MITM certificate. That said, my experience is that generally applications that have a legitimate reason for a limited-use self-signed certificate don't need to be in the general store. For example, it's common to set up OpenVPN with a self-signed certificate, but I've never had to add a certificate to the general store for that - it's always app-specific.