5 ms·

> Turns out an unrelated 3rd party can suddenly remotely disable Tor anonymity protections at their whim Am I the only one annoyed by people pushing this "they

by Faark 7y ago

> Turns out an unrelated 3rd party can suddenly remotely disable Tor anonymity protections at their whim Am I the only one annoyed by people pushing this "they flicked a switch" narrative? No. They provided shitty software that didn't work under certain conditions (in this case date related) and thus broke your shitty software. A third party having remote control capability is something entirely different.

judge2020 7y ago
If I'm not mistaken, then very well could revoke the intermediate certificate if they wanted. This wasn't a case of that, but it seems it could happen.
- crehn 7y ago
  Usually the whole certificate chain is distributed as a bundle, and most software don't bother checking revocations.
  - tedunangst 7y ago
    Are we talking about Firefox extensions or something else?
    - crehn 7y ago
      Not sure of the Firefox implementation; just pointing out revocation isn't necessarily straightforward.
      - tknkx 7y ago
        The way I understand it is: certificate revocation is handled by checking OCSP servers, and OCSP servers can be programmed so they give different answers depending on the IP address of whomever is asking. In other words, it should be possible to disable all addons for a selected user by targeting him by IP address.
        soulofmischief 7y ago
        That is such a massive security flaw, and if any other company had such a power over my browser experience I would drop their product immediately. Mozilla, you've really been testing my patience for the last two years.
        crehn 7y ago
        Seems that Firefox skips revocation checks for CA certs [1]. [1] https://wiki.mozilla.org/CA/Revocation_Checking_in_Firefox https://wiki.mozilla.org/CA/Revocation_Checking_in_Firefox
        marcinzm 7y ago
        Where does it say that? The link says they centrally manage revocations using OneCRL and then push a single revocation list to browsers (independent of browser updates). Which means they can revoke any certificate they want using that mechanism.
        crehn 7y ago
        Ah, you're correct. Seems they skip CA CRL/OCSP in favor of their own CRL. Thanks for the correction.
- floatingatoll 7y ago
  Does the intermediate have an OCSP URL, and/or does the CA that signed it have a CRL URL? One or both would need to be true for a normal revocation to have any effect.
netsharc 7y ago
Lack of understanding of the technology and excessive paranoia will lead to that, I guess. "I'm telling you people, the man's after us!", and this man gets to feel like he's the hero exposing some conspiracy.
- tinus_hn 7y ago
  Definitely a looney if they care about Mozilla having essentially a live backdoor into your computer if you’re running Tor. It’s not like they are a US company that the government can manipulate at will as long as they properly insinuate terrorism or child pornography. These guys can just be trusted, right?
steingold 7y ago
Letting a certificate expire is the same as flicking a switch IMO. Mozilla is a real organization with full time paid staff, things like this don't just slip through the cracks, especially when the 'fix' is to let Mozilla run spyware on your computer.
- Vinnl 7y ago
  I think almost anyone who has worked at real organisations with full-time paid staff can tell you that things do slip through the cracks. At least I can.
  - collsni 7y ago
    I do security for a large Enterprise. You'd be surprised how unorganized some of this shit is.
- floatingatoll 7y ago
  Your comment has a lovely silver lining: You believe it’s impossible for Mozilla to make such a mistake by accident! Anyone would be cheered to hear that, if presented positively; so I hope my callout of this can help the Mozilla folks working on this smile a little at the faith in them it shows.
tedunangst 7y ago
Flicking a switch, releasing the deadman's switch, is there really a difference?
MikusR 7y ago
Certificates can be renewed or revoked that's literary a switch. That the apparatus before or after switch is more complicated is irrelevant.
cjbprime 7y ago
The extension disabled itself due to expiry in this case, but it sounds like OP is upset that Mozilla can remotely disable extensions used by Tor users at will with a kill switch (which they didn't use here, but surely exists to combat malicious extensions). Some other people are also upset that the Normandy system has the capability of pushing extensions that it does and that it is apparently on by default. These both seem like reasonable concerns that are unrelated to the expiry but highlighted by it.
overgard 7y ago
> Am I the only one annoyed by people pushing this "they flicked a switch" narrative? What they set was essentially a dead mans switch, though. > A third party having remote control capability is something entirely different. They’re pushing fixes through a telemetry channel which can also be used to change your preferences soo..

by Faark 7y ago

judge2020 7y ago

If I'm not mistaken, then very well could revoke the intermediate certificate if they wanted. This wasn't a case of that, but it seems it could happen.

crehn 7y ago
Usually the whole certificate chain is distributed as a bundle, and most software don't bother checking revocations.
- tedunangst 7y ago
  Are we talking about Firefox extensions or something else?
  - crehn 7y ago
    Not sure of the Firefox implementation; just pointing out revocation isn't necessarily straightforward.
    - tknkx 7y ago
      The way I understand it is: certificate revocation is handled by checking OCSP servers, and OCSP servers can be programmed so they give different answers depending on the IP address of whomever is asking. In other words, it should be possible to disable all addons for a selected user by targeting him by IP address.
      - soulofmischief 7y ago
        That is such a massive security flaw, and if any other company had such a power over my browser experience I would drop their product immediately. Mozilla, you've really been testing my patience for the last two years.
      - crehn 7y ago
        Seems that Firefox skips revocation checks for CA certs [1]. [1] https://wiki.mozilla.org/CA/Revocation_Checking_in_Firefox https://wiki.mozilla.org/CA/Revocation_Checking_in_Firefox
        marcinzm 7y ago
        Where does it say that? The link says they centrally manage revocations using OneCRL and then push a single revocation list to browsers (independent of browser updates). Which means they can revoke any certificate they want using that mechanism.
        crehn 7y ago
        Ah, you're correct. Seems they skip CA CRL/OCSP in favor of their own CRL. Thanks for the correction.
floatingatoll 7y ago
Does the intermediate have an OCSP URL, and/or does the CA that signed it have a CRL URL? One or both would need to be true for a normal revocation to have any effect.

netsharc 7y ago

Lack of understanding of the technology and excessive paranoia will lead to that, I guess. "I'm telling you people, the man's after us!", and this man gets to feel like he's the hero exposing some conspiracy.

tinus_hn 7y ago
Definitely a looney if they care about Mozilla having essentially a live backdoor into your computer if you’re running Tor. It’s not like they are a US company that the government can manipulate at will as long as they properly insinuate terrorism or child pornography. These guys can just be trusted, right?

steingold 7y ago

Letting a certificate expire is the same as flicking a switch IMO. Mozilla is a real organization with full time paid staff, things like this don't just slip through the cracks, especially when the 'fix' is to let Mozilla run spyware on your computer.

Vinnl 7y ago
I think almost anyone who has worked at real organisations with full-time paid staff can tell you that things do slip through the cracks. At least I can.
- collsni 7y ago
  I do security for a large Enterprise. You'd be surprised how unorganized some of this shit is.
floatingatoll 7y ago
Your comment has a lovely silver lining: You believe it’s impossible for Mozilla to make such a mistake by accident! Anyone would be cheered to hear that, if presented positively; so I hope my callout of this can help the Mozilla folks working on this smile a little at the faith in them it shows.

tedunangst 7y ago

Flicking a switch, releasing the deadman's switch, is there really a difference?

MikusR 7y ago

Certificates can be renewed or revoked that's literary a switch. That the apparatus before or after switch is more complicated is irrelevant.

cjbprime 7y ago

The extension disabled itself due to expiry in this case, but it sounds like OP is upset that Mozilla can remotely disable extensions used by Tor users at will with a kill switch (which they didn't use here, but surely exists to combat malicious extensions). Some other people are also upset that the Normandy system has the capability of pushing extensions that it does and that it is apparently on by default. These both seem like reasonable concerns that are unrelated to the expiry but highlighted by it.

overgard 7y ago

> Am I the only one annoyed by people pushing this "they flicked a switch" narrative? What they set was essentially a dead mans switch, though. > A third party having remote control capability is something entirely different. They’re pushing fixes through a telemetry channel which can also be used to change your preferences soo..