6 ms·

So how many of the other CAs work with spyware / NSA / MI5 etc? Or corporate espionage? I doubt that these are the only bad eggs.

nsgi 4y ago
Certificate Transparency should be able to detect that
- mtgx 4y ago
ben_w 4y ago
My assumption is that most CAs have someone working for them who is also employed by an intelligence agency, possibly more than one from any given agency and more than one agency per CA (and more than one national government, e.g. both Russia and the USA have intelligence interests in Russia); this may be any combination of actively inserting malware, passively watching to get forewarning of zero-days before the CAs themselves know about them, and actively advising the CAs about exploits the agencies know about that aren't public yet. Most of the agencies are likely to be more subtle than this, given it took Snowden's whistleblowing for us to learn about much of what they actually got up to. But not all of them will be super-competent, and some of them will be spotted from the outside in much the way this was.
stevewatson301 4y ago
If you have evidence, I'm sure you can bring to the attention of the Mozilla Root Store Inclusion program and the CA/Browser forum. Moreover, "there are other criminals who have gotten away with much more" is not an argument.
- yonixw 4y ago
  I think the steel man version of the argument is: "You showed that there is no effective monitoring or transparency that me as a user can get, and as such, Where is the trust come from. What fundamentally causes Mozilla (or any) to trust CAs more than randomly distributed certificates."
  - stevewatson301 4y ago
    The CA/Browser forum's requirement and enforcements such as this one (and against DarkMatter, CNNIC and the likes) give me the required confidence to trust them, even though I'd agree it's not a perfect process. Your average user is unlikely to begin to understand why a CA would be trustworthy, and a web of trust model only works for social situations but not for certificate distribution.
  - tremon 4y ago
    "A moose once bit my sister. Therefore all meese must be sacked". I have trouble seeing this as a steeled version of anything. "People have uncovered a flaw in the system, therefore the entire system is unfit for purpose" does not really make a compelling argument. It displays selection bias, hasty generalization, nirvana fallacy, and something about babies and bathwater.
    - FeepingCreature 4y ago
      If people have "uncovered a flaw", but there is reasonable expectation that the flaw is very widespread and broadly ignored, then there is a reasonable suspicion that the flaw is being weaponized in this case. This is why in many legal systems it is in fact a valid defense to note that the law you are being prosecuted under is not being broadly applied, implying state caprice and corruption.
    - yonixw 4y ago
      > uncovered a flaw in the system I will argue it is not the a flaw in some random aspect of the system, but the main propose of the system. Which is to vet companies they trust to distribute it through CA signing. Do you think I will buy from a restaurant after finding they had expired food? Good food is the reason I'm there in the first place.
  - pas 4y ago
    CAA records and CT logs work, do browsers check them? I know nobody likes DNSSEC, but DANE works too :)
- radicalbyte 4y ago
  No I don't have evidence - however logical deduction shows that the probability of this happening is high. Any system involving humans is fallible, so it would be naïve to think that it doesn't happen. Or put another way: if I was the NSA or MI5 this is exactly how I would attack the problem of traffic interception or targeted black ops. Get a puppet CA via hook or crook. Totally agree that "there are other criminals who have gotten away with much more" is not an argument; I'm not sure what that has to do with my comment? I'm certainly not suggesting that. If anything I suggest that such systems are pretty much broken by design (at least if you care about state actors / extremely well funded actors).
matkoniecz 4y ago
I would assume that any decent spying agency can produce any certificate they want by some CA trusted by Chrome and Firefox and Safari. And not just NSA / Mossad, by also spying agency of an Estonia, Slovenia and Mexico. - Or is there reason to expect that is not happening? - And anyway that is not a good reason to let also known malware companies to do the same.
- GlitchMr 4y ago
  Certificate Transparency system requires certificates issued by CAs to be publicly reported, otherwise web browsers will reject them. Publicly reported certificates then can be monitored by anyone, and anything suspicious could be reported.

nsgi 4y ago

Certificate Transparency should be able to detect that

mtgx 4y ago

ben_w 4y ago

My assumption is that most CAs have someone working for them who is also employed by an intelligence agency, possibly more than one from any given agency and more than one agency per CA (and more than one national government, e.g. both Russia and the USA have intelligence interests in Russia); this may be any combination of actively inserting malware, passively watching to get forewarning of zero-days before the CAs themselves know about them, and actively advising the CAs about exploits the agencies know about that aren't public yet. Most of the agencies are likely to be more subtle than this, given it took Snowden's whistleblowing for us to learn about much of what they actually got up to. But not all of them will be super-competent, and some of them will be spotted from the outside in much the way this was.

stevewatson301 4y ago

If you have evidence, I'm sure you can bring to the attention of the Mozilla Root Store Inclusion program and the CA/Browser forum. Moreover, "there are other criminals who have gotten away with much more" is not an argument.

yonixw 4y ago
I think the steel man version of the argument is: "You showed that there is no effective monitoring or transparency that me as a user can get, and as such, Where is the trust come from. What fundamentally causes Mozilla (or any) to trust CAs more than randomly distributed certificates."
- stevewatson301 4y ago
  The CA/Browser forum's requirement and enforcements such as this one (and against DarkMatter, CNNIC and the likes) give me the required confidence to trust them, even though I'd agree it's not a perfect process. Your average user is unlikely to begin to understand why a CA would be trustworthy, and a web of trust model only works for social situations but not for certificate distribution.
- tremon 4y ago
  "A moose once bit my sister. Therefore all meese must be sacked". I have trouble seeing this as a steeled version of anything. "People have uncovered a flaw in the system, therefore the entire system is unfit for purpose" does not really make a compelling argument. It displays selection bias, hasty generalization, nirvana fallacy, and something about babies and bathwater.
  - FeepingCreature 4y ago
    If people have "uncovered a flaw", but there is reasonable expectation that the flaw is very widespread and broadly ignored, then there is a reasonable suspicion that the flaw is being weaponized in this case. This is why in many legal systems it is in fact a valid defense to note that the law you are being prosecuted under is not being broadly applied, implying state caprice and corruption.
  - yonixw 4y ago
    > uncovered a flaw in the system I will argue it is not the a flaw in some random aspect of the system, but the main propose of the system. Which is to vet companies they trust to distribute it through CA signing. Do you think I will buy from a restaurant after finding they had expired food? Good food is the reason I'm there in the first place.
- pas 4y ago
  CAA records and CT logs work, do browsers check them? I know nobody likes DNSSEC, but DANE works too :)
radicalbyte 4y ago
No I don't have evidence - however logical deduction shows that the probability of this happening is high. Any system involving humans is fallible, so it would be naïve to think that it doesn't happen. Or put another way: if I was the NSA or MI5 this is exactly how I would attack the problem of traffic interception or targeted black ops. Get a puppet CA via hook or crook. Totally agree that "there are other criminals who have gotten away with much more" is not an argument; I'm not sure what that has to do with my comment? I'm certainly not suggesting that. If anything I suggest that such systems are pretty much broken by design (at least if you care about state actors / extremely well funded actors).

matkoniecz 4y ago

I would assume that any decent spying agency can produce any certificate they want by some CA trusted by Chrome and Firefox and Safari. And not just NSA / Mossad, by also spying agency of an Estonia, Slovenia and Mexico. - Or is there reason to expect that is not happening? - And anyway that is not a good reason to let also known malware companies to do the same.

GlitchMr 4y ago
Certificate Transparency system requires certificates issued by CAs to be publicly reported, otherwise web browsers will reject them. Publicly reported certificates then can be monitored by anyone, and anything suspicious could be reported.