3 ms·

I suspect that the default reading of this text means "add your localhost.crt to the system's locally trusted roots" (or worse, "import the root certificate [to

I suspect that the default reading of this text means "add your localhost.crt to the system's locally trusted roots" (or worse, "import the root certificate [to your locally trusted roots]"). Although there are methods to "install localhost.crt in your list of locally trusted roots" so that it's only visible to your application, I'm concerned about the naive reading of the post. I would be very concerned to find that a random application like Spotify, is installing root certificates on my machine, as that would allow them to MITM any connection that doesn't have some kind of key pinning. Although not exactly the same case, because the driver's shenanigans had no legitimate use, while Spotify does have a legitimate use, an audio driver caught installing a CA root certificate was reported as a CVE vulnerability: https://www.kb.cert.org/vuls/id/446847 https://www.kb.cert.org/vuls/id/446847

vbezhenar 8y ago
Blizzard application installs root certificate: https://news.ycombinator.com/item?id=15982161 https://news.ycombinator.com/item?id=15982161 I can say that I wasn't even aware about it, it installs absolutely silently. So if you care about it, check it from time to time, because that random application may install it at any time!
- 0xCMP 8y ago
  It's not a root certificate in the CA sense. It can't sign new certificates and is only for the browser to communicate to the https server running on the same computer. The key isn't even distributed anywhere. It's generated locally and then marked trusted so the browsers don't show warnings. Checking the list of certificates from time to time is a good idea, although I wonder if anyone really does that very often without some automated help, but in this case Blizzard was doing something that was not only fine (using a self-signed cert to secure local traffic) but the absolutely correct way to do this. (As additionally explained by Let's Encrypt themselves) edit: I guess the one thing is: If you can find the certificate's private key you can serve your own server at that domain and launch an attack using a trusted certificate without needing admin permission to add your own malicious certificate.
  - vbezhenar 8y ago
    I agree, but for me their reasoning was weak and I would opt-out of this feature, because it's not even relevant for me. I don't like when someone messes with my trusted certificate store. And they installed that certificate absolutely silently, I learned about it from hacker news.
comex 8y ago
That was with a CA certificate, though. AFAIK, as long as the certificate marked as trusted does not have the CA flag set, and isn’t a wildcard cert for “*” or something silly like that, it can only be used to impersonate the specific domain(s) named in the certificate. Thus, even if the certificate is in the system global trust cache, it wouldn’t allow anyone to “MITM any connection that doesn't have some kind of key pinning”, only connections to that site. However, I can’t rule out that trusting a certificate for “localhost” for which an attacker knows the private key could still cause some sort of security vulnerability, though I’m not sure what exactly it would be.

vbezhenar 8y ago

Blizzard application installs root certificate: https://news.ycombinator.com/item?id=15982161 https://news.ycombinator.com/item?id=15982161 I can say that I wasn't even aware about it, it installs absolutely silently. So if you care about it, check it from time to time, because that random application may install it at any time!

0xCMP 8y ago
It's not a root certificate in the CA sense. It can't sign new certificates and is only for the browser to communicate to the https server running on the same computer. The key isn't even distributed anywhere. It's generated locally and then marked trusted so the browsers don't show warnings. Checking the list of certificates from time to time is a good idea, although I wonder if anyone really does that very often without some automated help, but in this case Blizzard was doing something that was not only fine (using a self-signed cert to secure local traffic) but the absolutely correct way to do this. (As additionally explained by Let's Encrypt themselves) edit: I guess the one thing is: If you can find the certificate's private key you can serve your own server at that domain and launch an attack using a trusted certificate without needing admin permission to add your own malicious certificate.
- vbezhenar 8y ago
  I agree, but for me their reasoning was weak and I would opt-out of this feature, because it's not even relevant for me. I don't like when someone messes with my trusted certificate store. And they installed that certificate absolutely silently, I learned about it from hacker news.

comex 8y ago

That was with a CA certificate, though. AFAIK, as long as the certificate marked as trusted does not have the CA flag set, and isn’t a wildcard cert for “*” or something silly like that, it can only be used to impersonate the specific domain(s) named in the certificate. Thus, even if the certificate is in the system global trust cache, it wouldn’t allow anyone to “MITM any connection that doesn't have some kind of key pinning”, only connections to that site. However, I can’t rule out that trusting a certificate for “localhost” for which an attacker knows the private key could still cause some sort of security vulnerability, though I’m not sure what exactly it would be.