8 ms·

Mozilla fears DarkMatter ‘misuse’ of browser for hacking

141 points by Santosh83 8y ago

kam 8y ago
If you thought the title was nonsense, it gets worse when the author tries to explain what a certificate authority does: > Websites that want to be designated as secure have to be certified by an outside organization, which will confirm their identity and vouch for their security. The certifying organization also helps secure the connection between an approved website and its users, promising the traffic will not be intercepted.
- nightfly 8y ago
  That is a perfectly reasonable description for a non-technical reader.
  - deleted 8y ago
    [deleted]
  - kam 8y ago
    The biggest issue with it to me is the "vouch for their security" part, perpetuating the myth that HTTPS means the site is "safe" or that a certificate is a security audit of some kind.
  - stordoff 8y ago
    I'm not a fan of promise - it makes it sound like a choice, and not something enforced by the design (assuming it's set up properly, which the CA _can't_ promise).
- kbenson 8y ago
  It's actually not all that wrong, given a very loose and forgiving interpretation of what they mean. Certificate authorities do "help" secure the connection by providing trust by "promising the traffic will not be intercepted" through an exploit in their certificate, and oftentimes insuring the connection to provide this trust (that's a lot of the difference in price between cheap and expensive certs, they insure for more). You could say this helps secure the connection by providing enough assurance that people are then willing to use the connection at all. Welcome to the world of marketing and PR, where loose terminology, ambiguous phrasing means and a little imagination means never having to say you were wrong...
  - jarfil 8y ago
    That kind of explanation is how a company could "promise the traffic will not be intercepted" while using ROT13 to secure it. Also the insurances/warranties are a joke, the way they're written, there is pretty much no way anyone will be able to ever land a claim against them.
  - tialaramex 8y ago
    Yeah, no, it's pretty badly wrong. Sometimes you will see a journalist say something that's just _technically_ wrong, in an "Um... actually" kind of way. Like saying there are 4 billion "Internet addresses". Yeah it's actually 2^32 and those are IPv4 addresses, and anyway some are in reserved classes we can never use and... We shouldn't care about these cases, it's fun to make a big deal as a _nerd_ but it's not a real problem. But here they are misleading people as to the general purpose of a CA. The CA doesn't in fact promise "traffic will not be intercepted" and how could they. The CA promises that their subscriber proved to them that they know a private key to which the corresponding public key is in the certificate, and that they control the things (usually FQDNs) named in the certificate. Insurance, as another poster points out, is basically worthless. In fact it's worthless in multiple independent ways, it's deliberately engineered to _be_ worthless. For consumer insurance that would be illegal in many countries (taking people's money to "insure" against a risk that won't happen is prohibited in those countries), but they don't sell it to consumers, they sell it to the Certificate Authority and non-individuals are more free to make bad decisions since nobody important will get hurt.
    - matthewmacleod 8y ago
      The CA doesn't in fact promise "traffic will not be intercepted" and how could they. The CA promises that their subscriber proved to them that they know a private key to which the corresponding public key is in the certificate, and that they control the things (usually FQDNs) named in the certificate. Right, but surely you see how 90% of that statement is utterly incomprehensible to a general audience?
      - tialaramex 8y ago
snazzycalynx 8y ago
Did someone use Fiferox on macOS?
oger 8y ago
I had to read it twice to get that they were writing about a CA. Definitly a writer without a clue.
- billyhoffman 8y ago
  Compounding the problem was that the author kept using the word "safe". FTA: "While Mozilla had been considering whether to grant DarkMatter the authority to certify websites as safe, two Mozilla executives said in an interview last week that Reuters’ report raised concerns about whether DarkMatter would abuse that authority." Conflating "safe" or "secure" with "this website is who they say they are" may make it easier for a lay person to understand, but is wrong and creates a dangerous impression.
steventhedev 8y ago
Can the admins change this to point to the actual mailing list thread[0]? I'm still reading through the thread, but it seems that DarkMatter have some small technical issues around issuing certifications. Specifically, the claims seem to be: 1. using 63 bits of entropy for the serial number instead of the required 64. 2. name constraints were incorrectly filled in for their intermediate certificates. 3. DarkMatter's other business units may compromise the CA internally for malicious purposes. [0]: https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/nnLVNfqgz7g https://groups.google.com/forum/#!topic/mozilla.dev.security... EDIT: more background - DarkMatter have an open request to be included in the Mozilla CA Store[1], and are currently trusted through intermediate certificates rooted with QuoVadis, who were recently acquired by DigiCert. [1]: https://bugzilla.mozilla.org/show_bug.cgi?id=1427262 https://bugzilla.mozilla.org/show_bug.cgi?id=1427262
- bluesign 8y ago
  I think DarkMatter is right on 64 bit entropy discussion, requirements are clearly wrong unfortunately. - it says you should use 64-bit entropy as output from a CSPRNG - it says Serial number is a signed number If you use 64bit serial, you clearly lose 1 bit. That means any certificate with 64bit serial is not conforming to the standard.
  - johncolanduoni 8y ago
    How does that mean the requirements are wrong? Larger than 8 byte serials are allowed in the certificates, as is mentioned in that thread. I don't see how the requirements of the CA forum and the certificate representation can be taken as inherently contradictory instead of simply requiring a larger than 8 byte serial.
    - bluesign 8y ago
      It is not contradictory but it can be confusing when many parties involved. You have some software to get key for serial from RNG, when you get 64 bit and put it to serial field, you feel it is ok. This is probably what happened in this case. But if requirements made sure lets say signature part is 64bit random + some extra (serial, identifier etc) forcing serial field to be one more octet, this could never happen.
vik016 8y ago
Sometimes I find Reuters stories boring compared to all the superficially exciting news produced by everyone else. But these are the kind of stories that make me thankful they exist. That contrast, in distracting times, reminds me of what choices I make when I consume news. Kudos to Mozilla for keeping things open. Holding on to your values, in cut throat competitve times is fucking hard. Mad respect.
- hannob 8y ago
  I'm not sure for what you praise Reuters here. This story has been reported by multiple news sites before, and I don't see that Reuters adds anything that hasn't been reported before. (Except if you mean the original Reuters / Project Raven story that was indeed exceptionally.)
throw2016 8y ago
This is a pattern. Mozilla and others are furthering the interests of gatekeepers under the pretext of 'end user security'. The browser community have been scaremongering against self signed certs for years now and yet are happily handing 'authority' to shady projects in the middle east. What does one make of that? Because of this obsession with 'central authority' even local ajax calls to 127.0.0.1 and localhost are blocked by Mozilla. What is even worse is they are doing this intentionally inspite of the standards explicitly not requiring this for localhost or 127.0.0.1 and are misleading users on bug reports and wasting their time. [1][2][3] Some have wasted days mucking about with cors headers and ssl only to realize this is a Firefox only issue. Even Chrome which is not shy about furthering gatekeepers and their own interests doesn't do this. Needless to say this is not a problem on any other browser. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=903966 https://bugzilla.mozilla.org/show_bug.cgi?id=903966 [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1440370 https://bugzilla.mozilla.org/show_bug.cgi?id=1440370 [3] https://stackoverflow.com/questions/51269439/why-are-my-requests-from-https-domain-to-http-localhost-failing-cors https://stackoverflow.com/questions/51269439/why-are-my-requ...
- rhn_mk1 8y ago
  Reading the bug reports, it seems that Firefox allows access to 127.0.0.1 ports if the originating website is not https. This is weird - I would never want some random site control my local services (including LAN) without getting an explicit permission. This leads to vulnerabilities: https://lwn.net/Articles/703485/ https://lwn.net/Articles/703485/
  - throw2016 8y ago
    A standard website cannot access your local services. 127.0.0.1 and localhost are local addresses to the server, not the end user system. Private addresses cannot be accessed over the public internet. This is about a server accessing backend local services on the server or local private network via a SSL terminating reverse proxy etc.
    - rhn_mk1 8y ago
michaelt 8y ago
I've got to say, DarkMatter seems suspicious to me just because they're trying to enter the CA business when Let's Encrypt already exists. I can understand legacy CAs staying around as long as their existing customers keep paying. And I'm sure there will be an ongoing market for one or two other CAs specialising in the needs of big corporations. But starting a new CA today, trying to sell a product that's available for free? You've gotta wonder where they think they're going to add value.
- niea_11 8y ago
  But Let's Encrypt doesn't offer Organization Validation and Extended Validation (which other CAs offer for a fee). So there is always a market for a new CA.
- Jaepa 8y ago
  Yeah. I really really can't think of a single valid reason why DarkMatter would want this that is not malicious. From the EFF > The concern in this case is that DarkMatter has made its business spying on internet communications, hacking dissidents’ iPhones, and other cyber-mercenary work. DarkMatter’s business objectives directly depend on intercepting end-user traffic on behalf of snooping governments. Giving DarkMatter a trusted root certificate would be like letting the proverbial fox guard the henhouse. Its also worth mentioning that the FF truststore is regularly used as the truststore in various flavors of Linux. https://www.eff.org/deeplinks/2019/02/cyber-mercenary-groups-shouldnt-be-trusted-your-browser-or-anywhere-else https://www.eff.org/deeplinks/2019/02/cyber-mercenary-groups...
- unethical_ban 8y ago
  Well, we shouldn't want a single CA, no matter the organization. We should always have at least several that are independent in its leadership, ownership and auditing. And yes, there are things LE doesn't yet offer. They still don't do EV, SANs, or wildcards do they?
  - LinuxBender 8y ago
    They do wildcard certificates now, I have several of them. I _think_ they do SAN as well.
gpm 8y ago
The main thing this thread (going with steventhedev's link) demonstrates to me is that the CA program is completely broken. Here we have a potential CA that is - Demonstrably involved in internet surveillance [0] - Doesn't understand the word "entropy" [1] or intentionally interprets the guidelines in an obtuse manner in which the sequence 0, 1, 2, ... can be considered randomly generated with 64 bits of entropy [2]. - Likely in the business of lying [3] (either they are lying or reuters is thoroughly mistaken or lying) How could whatever public benefit is gained by including these people as a CA possibly outweigh the risk? I'd think that any one of the above should disqualify them. It also seems completely backwards that the root CAs publish certificates that give subCAs equivalent power while not having the subCAs go through the same level of scrutiny as root CAs. [0] https://www.reuters.com/investigates/special-report/usa-spying-raven/ https://www.reuters.com/investigates/special-report/usa-spyi... - also whatever you think "defensive cyber security" means. [1] This is after repeated prompting and consulting with engineers (hint for those not familiar with entropy, it's not possible to have more than x bits of entropy in a x bit random number, and they are using a 63 bit number) https://groups.google.com/forum/#!msg/mozilla.dev.security.policy/nnLVNfqgz7g/_OPSSs2uAAAJ https://groups.google.com/forum/#!msg/mozilla.dev.security.p... [2] Kindly pointed out by Matt Palmer: https://groups.google.com/d/msg/mozilla.dev.security.policy/nnLVNfqgz7g/c6HoK97RBQAJ https://groups.google.com/d/msg/mozilla.dev.security.policy/... [3] Compare mentions of dark matters in the first link, to there statement in the second link (one assumes that any reasonable definition of defensive does not involve spying on people in other nations) - https://www.reuters.com/investigates/special-report/usa-spying-raven/ https://www.reuters.com/investigates/special-report/usa-spyi... - https://groups.google.com/d/msg/mozilla.dev.security.policy/nnLVNfqgz7g/C2A-t0xMBQAJ https://groups.google.com/d/msg/mozilla.dev.security.policy/...
- gruez 8y ago
  >It also seems completely backwards that the root CAs publish certificates that give subCAs equivalent power while not having the subCAs go through the same level of scrutiny as root CAs. AFAIK the logic is that the since root CA is fronting the risk (in case of any misissuance), there doesn't need to be any extra scrutiny on the part of browser vendors. Besides, if this was somehow outlawed, then the root CA will simply provide a API that rubber-stamps whatever certificate is requested.

141 points by Santosh83 8y ago

kam 8y ago

If you thought the title was nonsense, it gets worse when the author tries to explain what a certificate authority does: > Websites that want to be designated as secure have to be certified by an outside organization, which will confirm their identity and vouch for their security. The certifying organization also helps secure the connection between an approved website and its users, promising the traffic will not be intercepted.

nightfly 8y ago
That is a perfectly reasonable description for a non-technical reader.
- deleted 8y ago
  [deleted]
- kam 8y ago
  The biggest issue with it to me is the "vouch for their security" part, perpetuating the myth that HTTPS means the site is "safe" or that a certificate is a security audit of some kind.
- stordoff 8y ago
  I'm not a fan of promise - it makes it sound like a choice, and not something enforced by the design (assuming it's set up properly, which the CA _can't_ promise).
kbenson 8y ago
It's actually not all that wrong, given a very loose and forgiving interpretation of what they mean. Certificate authorities do "help" secure the connection by providing trust by "promising the traffic will not be intercepted" through an exploit in their certificate, and oftentimes insuring the connection to provide this trust (that's a lot of the difference in price between cheap and expensive certs, they insure for more). You could say this helps secure the connection by providing enough assurance that people are then willing to use the connection at all. Welcome to the world of marketing and PR, where loose terminology, ambiguous phrasing means and a little imagination means never having to say you were wrong...
- jarfil 8y ago
  That kind of explanation is how a company could "promise the traffic will not be intercepted" while using ROT13 to secure it. Also the insurances/warranties are a joke, the way they're written, there is pretty much no way anyone will be able to ever land a claim against them.
- tialaramex 8y ago
  Yeah, no, it's pretty badly wrong. Sometimes you will see a journalist say something that's just _technically_ wrong, in an "Um... actually" kind of way. Like saying there are 4 billion "Internet addresses". Yeah it's actually 2^32 and those are IPv4 addresses, and anyway some are in reserved classes we can never use and... We shouldn't care about these cases, it's fun to make a big deal as a _nerd_ but it's not a real problem. But here they are misleading people as to the general purpose of a CA. The CA doesn't in fact promise "traffic will not be intercepted" and how could they. The CA promises that their subscriber proved to them that they know a private key to which the corresponding public key is in the certificate, and that they control the things (usually FQDNs) named in the certificate. Insurance, as another poster points out, is basically worthless. In fact it's worthless in multiple independent ways, it's deliberately engineered to _be_ worthless. For consumer insurance that would be illegal in many countries (taking people's money to "insure" against a risk that won't happen is prohibited in those countries), but they don't sell it to consumers, they sell it to the Certificate Authority and non-individuals are more free to make bad decisions since nobody important will get hurt.
  - matthewmacleod 8y ago
    The CA doesn't in fact promise "traffic will not be intercepted" and how could they. The CA promises that their subscriber proved to them that they know a private key to which the corresponding public key is in the certificate, and that they control the things (usually FQDNs) named in the certificate. Right, but surely you see how 90% of that statement is utterly incomprehensible to a general audience?
    - tialaramex 8y ago

snazzycalynx 8y ago

Did someone use Fiferox on macOS?

oger 8y ago

I had to read it twice to get that they were writing about a CA. Definitly a writer without a clue.

billyhoffman 8y ago
Compounding the problem was that the author kept using the word "safe". FTA: "While Mozilla had been considering whether to grant DarkMatter the authority to certify websites as safe, two Mozilla executives said in an interview last week that Reuters’ report raised concerns about whether DarkMatter would abuse that authority." Conflating "safe" or "secure" with "this website is who they say they are" may make it easier for a lay person to understand, but is wrong and creates a dangerous impression.

steventhedev 8y ago

Can the admins change this to point to the actual mailing list thread[0]? I'm still reading through the thread, but it seems that DarkMatter have some small technical issues around issuing certifications. Specifically, the claims seem to be: 1. using 63 bits of entropy for the serial number instead of the required 64. 2. name constraints were incorrectly filled in for their intermediate certificates. 3. DarkMatter's other business units may compromise the CA internally for malicious purposes. [0]: https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/nnLVNfqgz7g https://groups.google.com/forum/#!topic/mozilla.dev.security... EDIT: more background - DarkMatter have an open request to be included in the Mozilla CA Store[1], and are currently trusted through intermediate certificates rooted with QuoVadis, who were recently acquired by DigiCert. [1]: https://bugzilla.mozilla.org/show_bug.cgi?id=1427262 https://bugzilla.mozilla.org/show_bug.cgi?id=1427262

bluesign 8y ago
I think DarkMatter is right on 64 bit entropy discussion, requirements are clearly wrong unfortunately. - it says you should use 64-bit entropy as output from a CSPRNG - it says Serial number is a signed number If you use 64bit serial, you clearly lose 1 bit. That means any certificate with 64bit serial is not conforming to the standard.
- johncolanduoni 8y ago
  How does that mean the requirements are wrong? Larger than 8 byte serials are allowed in the certificates, as is mentioned in that thread. I don't see how the requirements of the CA forum and the certificate representation can be taken as inherently contradictory instead of simply requiring a larger than 8 byte serial.
  - bluesign 8y ago
    It is not contradictory but it can be confusing when many parties involved. You have some software to get key for serial from RNG, when you get 64 bit and put it to serial field, you feel it is ok. This is probably what happened in this case. But if requirements made sure lets say signature part is 64bit random + some extra (serial, identifier etc) forcing serial field to be one more octet, this could never happen.

vik016 8y ago

Sometimes I find Reuters stories boring compared to all the superficially exciting news produced by everyone else. But these are the kind of stories that make me thankful they exist. That contrast, in distracting times, reminds me of what choices I make when I consume news. Kudos to Mozilla for keeping things open. Holding on to your values, in cut throat competitve times is fucking hard. Mad respect.

hannob 8y ago
I'm not sure for what you praise Reuters here. This story has been reported by multiple news sites before, and I don't see that Reuters adds anything that hasn't been reported before. (Except if you mean the original Reuters / Project Raven story that was indeed exceptionally.)

throw2016 8y ago

This is a pattern. Mozilla and others are furthering the interests of gatekeepers under the pretext of 'end user security'. The browser community have been scaremongering against self signed certs for years now and yet are happily handing 'authority' to shady projects in the middle east. What does one make of that? Because of this obsession with 'central authority' even local ajax calls to 127.0.0.1 and localhost are blocked by Mozilla. What is even worse is they are doing this intentionally inspite of the standards explicitly not requiring this for localhost or 127.0.0.1 and are misleading users on bug reports and wasting their time. [1][2][3] Some have wasted days mucking about with cors headers and ssl only to realize this is a Firefox only issue. Even Chrome which is not shy about furthering gatekeepers and their own interests doesn't do this. Needless to say this is not a problem on any other browser. [1] https://bugzilla.mozilla.org/show_bug.cgi?id=903966 https://bugzilla.mozilla.org/show_bug.cgi?id=903966 [2] https://bugzilla.mozilla.org/show_bug.cgi?id=1440370 https://bugzilla.mozilla.org/show_bug.cgi?id=1440370 [3] https://stackoverflow.com/questions/51269439/why-are-my-requests-from-https-domain-to-http-localhost-failing-cors https://stackoverflow.com/questions/51269439/why-are-my-requ...

rhn_mk1 8y ago
Reading the bug reports, it seems that Firefox allows access to 127.0.0.1 ports if the originating website is not https. This is weird - I would never want some random site control my local services (including LAN) without getting an explicit permission. This leads to vulnerabilities: https://lwn.net/Articles/703485/ https://lwn.net/Articles/703485/
- throw2016 8y ago
  A standard website cannot access your local services. 127.0.0.1 and localhost are local addresses to the server, not the end user system. Private addresses cannot be accessed over the public internet. This is about a server accessing backend local services on the server or local private network via a SSL terminating reverse proxy etc.
  - rhn_mk1 8y ago

michaelt 8y ago

I've got to say, DarkMatter seems suspicious to me just because they're trying to enter the CA business when Let's Encrypt already exists. I can understand legacy CAs staying around as long as their existing customers keep paying. And I'm sure there will be an ongoing market for one or two other CAs specialising in the needs of big corporations. But starting a new CA today, trying to sell a product that's available for free? You've gotta wonder where they think they're going to add value.

niea_11 8y ago
But Let's Encrypt doesn't offer Organization Validation and Extended Validation (which other CAs offer for a fee). So there is always a market for a new CA.
Jaepa 8y ago
Yeah. I really really can't think of a single valid reason why DarkMatter would want this that is not malicious. From the EFF > The concern in this case is that DarkMatter has made its business spying on internet communications, hacking dissidents’ iPhones, and other cyber-mercenary work. DarkMatter’s business objectives directly depend on intercepting end-user traffic on behalf of snooping governments. Giving DarkMatter a trusted root certificate would be like letting the proverbial fox guard the henhouse. Its also worth mentioning that the FF truststore is regularly used as the truststore in various flavors of Linux. https://www.eff.org/deeplinks/2019/02/cyber-mercenary-groups-shouldnt-be-trusted-your-browser-or-anywhere-else https://www.eff.org/deeplinks/2019/02/cyber-mercenary-groups...
unethical_ban 8y ago
Well, we shouldn't want a single CA, no matter the organization. We should always have at least several that are independent in its leadership, ownership and auditing. And yes, there are things LE doesn't yet offer. They still don't do EV, SANs, or wildcards do they?
- LinuxBender 8y ago
  They do wildcard certificates now, I have several of them. I _think_ they do SAN as well.

gpm 8y ago

The main thing this thread (going with steventhedev's link) demonstrates to me is that the CA program is completely broken. Here we have a potential CA that is - Demonstrably involved in internet surveillance [0] - Doesn't understand the word "entropy" [1] or intentionally interprets the guidelines in an obtuse manner in which the sequence 0, 1, 2, ... can be considered randomly generated with 64 bits of entropy [2]. - Likely in the business of lying [3] (either they are lying or reuters is thoroughly mistaken or lying) How could whatever public benefit is gained by including these people as a CA possibly outweigh the risk? I'd think that any one of the above should disqualify them. It also seems completely backwards that the root CAs publish certificates that give subCAs equivalent power while not having the subCAs go through the same level of scrutiny as root CAs. [0] https://www.reuters.com/investigates/special-report/usa-spying-raven/ https://www.reuters.com/investigates/special-report/usa-spyi... - also whatever you think "defensive cyber security" means. [1] This is after repeated prompting and consulting with engineers (hint for those not familiar with entropy, it's not possible to have more than x bits of entropy in a x bit random number, and they are using a 63 bit number) https://groups.google.com/forum/#!msg/mozilla.dev.security.policy/nnLVNfqgz7g/_OPSSs2uAAAJ https://groups.google.com/forum/#!msg/mozilla.dev.security.p... [2] Kindly pointed out by Matt Palmer: https://groups.google.com/d/msg/mozilla.dev.security.policy/nnLVNfqgz7g/c6HoK97RBQAJ https://groups.google.com/d/msg/mozilla.dev.security.policy/... [3] Compare mentions of dark matters in the first link, to there statement in the second link (one assumes that any reasonable definition of defensive does not involve spying on people in other nations) - https://www.reuters.com/investigates/special-report/usa-spying-raven/ https://www.reuters.com/investigates/special-report/usa-spyi... - https://groups.google.com/d/msg/mozilla.dev.security.policy/nnLVNfqgz7g/C2A-t0xMBQAJ https://groups.google.com/d/msg/mozilla.dev.security.policy/...

gruez 8y ago
>It also seems completely backwards that the root CAs publish certificates that give subCAs equivalent power while not having the subCAs go through the same level of scrutiny as root CAs. AFAIK the logic is that the since root CA is fronting the risk (in case of any misissuance), there doesn't need to be any extra scrutiny on the part of browser vendors. Besides, if this was somehow outlawed, then the root CA will simply provide a API that rubber-stamps whatever certificate is requested.