8 ms·

How to destroy a certificate authority in one month

276 points by JoshTriplett 4y ago

maltris 4y ago
Whats wrong with that person?
hakanderyal 4y ago
This is a good summary of events, and the finishing of the article with that last sentence makes it a worthy read. "Saying that would have gotten her company destroyed even faster, but I think she would have been right." If you are also a sucker for some fun internet drama, definitely follow the dev-security-policy@mozilla.org mailing list.
- throw_a_grenade 4y ago
  Sadly, just yesterday Kathleen changed settings to manual approval of all signups: https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/gINEG-n1R_M https://groups.google.com/a/mozilla.org/g/dev-security-polic... But yes, we who are already subscribed will enjoy the sporadic, but colourful drama that brews there.
  - duskwuff 4y ago
    You can browse the archives through the Google Groups web interface without subscribing.
  - teddyh 4y ago
    It’s readable via <nntp://news.gmane.io/gmane.comp.mozilla.devel.security-policy>
  - themoonisachees 4y ago
    If you just want to read, the emails are readable on the web without being subscribed.
wolfgang42 4y ago
Previously on HN: Concerns about Trustcor (70 days ago, 36 comments): https://news.ycombinator.com/item?id=33541718 https://news.ycombinator.com/item?id=33541718 Mozilla moves to distrust the TrustCor CA (49 days ago, 64 comments): https://news.ycombinator.com/item?id=33813660 https://news.ycombinator.com/item?id=33813660 Mozilla, Microsoft yank TrustCor's root certificate authority (49 days ago, 354 comments): https://news.ycombinator.com/item?id=33810755 https://news.ycombinator.com/item?id=33810755 Linux Certificate Authority root stores have a too simple view of 'trust' (44 days ago, 118 comments): https://news.ycombinator.com/item?id=33876949 https://news.ycombinator.com/item?id=33876949 Being able to partially distrust a Certificate Authority is good (43 days ago, 14 comments): https://news.ycombinator.com/item?id=33890823 https://news.ycombinator.com/item?id=33890823
advisedwang 4y ago
> The conclusion on the mailing list was roughly: look, we're not here to find you guilty in a court of law, we're here to decide whether we trust you, and after all that we definitely don't. They weren't untrusted just because of the behaviour. A really important dimension is that TrustCor certificates were only being used for very limited purpose. The actual decision is a a cost vs benefit analysis from the point of view of internet users. Because there's so little benefit, it takes only very little untrustworthiness before the best course of action is to distrust.
- throw_a_grenade 4y ago
  The browsers constantly wield this argument, but I don't like it. It necessarily leads to centralisation of CAs and going back to old days of VeriSign. I don't think we should be going towards LE/ISRG being the only organisation allowed to issue certificates for "cost vs benefits analysis" of allowing other entities to issue certs. It would be a single point of failure and a massive target for various non-state and state actors.
  - lolinder 4y ago
    I agree in general, but in this case it was pretty clear-cut: TrustCor was a CA primarily to serve a single product, MsgSafe.io. This is the same product that was found to have bundled the only known unobfuscated Measurement Systems malware and was also found to be claiming E2E encryption when very rudimentary tests showed they couldn't possibly be encrypting the email. Since their only known benefit was issuing certificates in support of a quite-possibly-shady email system, I'm comfortable with saying that the cost-benefit analysis comes down firmly against TrustCor.
    - mewse 4y ago
      The "the only product known to have embedded unobfuscated Measurement Systems malware" phrase got used a whole lot, in the OP and in comments here as well as in the original email thread, but nobody really explained why that factor was important (or maybe I just missed it?) Can somebody explain the significance of the malware being unobfuscated, and why that's apparently more concerning than if it had been obfuscated?
ipaddr 4y ago
This is why we saw the huge push to https. Google developers being able to control who is allowed to issue a certificate might have worked well in 2004 but not now.
- deleted 4y ago
  [deleted]
blibble 4y ago
the thread in question: https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ https://groups.google.com/a/mozilla.org/g/dev-security-polic... really quite amazing to read the whataboutism starts about 50% of the way down
- babelfish 4y ago
  HN thread from that time https://news.ycombinator.com/item?id=33813660 https://news.ycombinator.com/item?id=33813660
woodruffw 4y ago
I think the final claim is amusing and thought provoking, but maybe not actually true: getting hellbanned by browsers is extremely visible, and I don’t think merely being critical of Google (even in disparaging language) would result in them risking their appearance of impartiality.
- TheDong 4y ago
  I believe the suggestion is not to _just_ say "google is an adware company". It's to say "sure we shipped spyware to android, we're guilty of what we are accused of, but google does it too and steals all the same information, but from even more people" > I don’t think merely being critical of Google (even in disparaging language) would result in them risking their appearance of impartiality. But saying "yes, we shipped the malware you claim we did" would have gotten them removed quickly, which is again what I think the actual suggestion was.
  - woodruffw 4y ago
    That's a finer point, sure, but I don't think anybody operates under the pretense that (1) Google is not an advertising and analytics company, or that (2) Google willfully introduces malware to end user devices (even if their actual software could be reasonably characterized as adware or spyware).
akira2501 4y ago
I don't understand the argument. Imply without data that 90% of a mailing list works for Google, and further imply that their involvement with an open standard is actually a ploy to secretly benefit their advertising business? That doesn't seem very much like a "high road" to me.
- calibas 4y ago
  > Imply without data that 90% of a mailing list works for Google... Not what the article says. Here's the exact statement: "most of the people on that mailing list work either for or with Google" > and further imply that their involvement with an open standard is actually a ploy to secretly benefit their advertising business Also not what the article says. It's implied there's a conflict of interest, which is true, but not some kind of secret ploy.
lolinder 4y ago
One thing not mentioned is that the TrustCor VP (Rachel McPherson) spent the entire discussion trying to distance TrustCor from MsgSafe, the product that was coming under scrutiny for bundling the malware and engaging in false advertising about its encryption. She repeatedly categorized MsgSafe as a distinct business unit "operated separately and independently from TrustCor CA" to try to insulate the CA from getting damaged by MsgSafe's obvious problems. One of the key factors in Mozilla's decision was that this supposed operational independence was a lie, because Rachel herself was the Director/VP of Operations for both business units [0]: > The same individual was responsible for the day to day operation of both TrustCor’s CA business and MsgSafe. They are listed on TrustCor’s website as the VP of TrustCor’s CA operations and the Director of Operations for MsgSafe. [2] > ... > [2] Rachel McPherson is listed as the Vice President of Operations, having “access-to and control-over the CA and CA Business Operations” in a company document submitted privately by Rachel to Mozilla. Press releases on TrustCor’s website list Rachel McPherson as MsgSafe.io’s Director of Operations, e.g. https://web.archive.org/web/20221108224150/https://trustcor https://web.archive.org/web/20221108224150/https://trustcor..... [0] https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ https://groups.google.com/a/mozilla.org/g/dev-security-polic...
- ethbr0 4y ago
  The bad taste this left in my mouth was the glee with which it was conducted. Delisting a CA is a thing you can do. It is a serious thing you can do. But the internet drama surrounding this, and some posts on the mailing list itself, were overly emotional. "Ha! We caught you! You damned executive, you!" is not exactly the tone with which I'd want to conduct weighty matters. It was like looking back into the early-90s, when pitchforks-and-torches-because-we-technically-can were the norm. I don't miss those days, and I'd thought the internet had grown up more. Apologies in advance for being the no-fun police, but we're talking about destroying a business. Even if it's a shitty business, run by shitty people, trying to do shitty things... just don't fucking dance. https://m.youtube.com/watch?v=0k5aVLi_yhM https://m.youtube.com/watch?v=0k5aVLi_yhM
  - akerl_ 4y ago
btown 4y ago
From the article: > [Google is a] company that also distributes spyware, because they don't check what their ad customers are doing very well and let them run random JavaScript on random web pages. Is this true? While it's absolutely the case that websites have very little control over what ad content is displayed (see, for instance, the work of https://checkmyads.org/ https://checkmyads.org/), I don't think I've ever seen evidence that ad publishers, or anyone in that massive ecosystem, can inject arbitrary code, running in the browser's context, into websites who monetize through Google AdSense script tags alone. Of course, Google touches other parts of the pipeline, and I'm sure that in their trillions of transactions, they have unknowingly participated in or facilitated transactions that route/suggest malicious ads to other AdSense-like ad-embedding or tracking solutions that might have RCE vulnerabilities. But it seems a bit of a stretch to call this "distributing spyware," any more so that it is to call a customs official who misses an illegal package a smuggler.
- EdwardDiego 4y ago
  Every ad these days is 'spyware', despite the ineffectiveness of "personalized adverts". I worked for an SSP, and always loved the data we got back from DMPs categorising the same user into "segments". Sometimes they were a man, until five impressions later they weren't, the guesses at age varied significantly also. That said, none of those DMPs were Google. I believe that they'd actually be able to correctly segment you, because, well, it's Google, one of the companies putting the brightest minds of our generation to work on the problem of optimising CTR.
  - b112 4y ago
    The idea that a family, a household, or even just roommates, with no gmail, no login to much of anything, might all use the same computer, or even share a tablet? Well, that must give people at google a conniption fit.
    - EdwardDiego 4y ago
      They can distinguish you based on some fingerprinting and, most importantly, browsing behavior. That's what FLoC was about - with enough data, you don't need third party cookies to recognise a user.
superkuh 4y ago
Now extend this by thinking about how HTTP/2 and HTTP/3 implementations in all major browsers (and the libs they use) don't allow you to establish a connection without a CA based TLS cert. It's going to make the already rocky CA/Browser/User triad even more fraught with dangers.
- mattwilsonn888 4y ago
  I would be interested in reading more if you cared to elaborate or provide some link(s).
- woodruffw 4y ago
  As far as I know, you can use a self-signed certificate with HTTP/2 in every major browser.
gzer0 4y ago
Naturally, this led me to research how does one even become a CA? * Developing and implementing a robust security infrastructure * Completing an application process * Undergoing an audit and validation process * Obtaining accreditation from a recognized organization * Maintaining compliance with accreditation requirements. and then: * On average, it can take several months to a year or more to complete the process of becoming a CA. This includes the time required for developing and implementing the necessary policies and procedures, completing the application process, undergoing the audit and validation process, and obtaining accreditation. Wow, throwing away several months to a year of effort. It truly is something that takes time. I guess, a determined adversary will play the long con.
- kseifried 4y ago
  Witness bjca.cn: https://groups.google.com/a/ccadb.org/g/public/c/o9lbCbr92Ug https://groups.google.com/a/ccadb.org/g/public/c/o9lbCbr92Ug The summary of the public discussion is worrying: Summary of Discussion and Action Items Discussion Item #1: A concern was raised about BJCA’s Beijing One Pass software, which apparently facilitates client access to a digital portal or platform. It was noted that BJCA had attempted to address suspicions about the software in Comment #15, that the software was needed to support a USB token and to install another certificate chain, and not the two above-referenced roots. A follow-up question was whether a security report concerning the software would be made publicly available. BJCA Response to Discussion Item #1: “This report is a communication document between our company and the competent government department, and it is not suitable for disclosure or submission to Mozilla because it involves confidential information. And because the security incident does not involve the certificate chain of the root inclusion case submitted to Mozilla this time, we made a clarification in the Mozilla root inclusion case by disclosing the main points of the report.” ========================== Discussion Item #2: Two components were also mentioned: wmControl.exe and zfkeymonitor.exe. BJCA Response to Discussion Item #2: The “suspected spyware behavior indicated in the report was caused by one of the drivers, wmControl.exe. This program is a driver provided by the USB Token manufacturer, Its software behavior is different from spyware and does not have malicious behavior. It is intended to ensure the normal use of this type of [device] in the browser. In addition, the USB Token for digital certificate corresponding to the driver wmControl.exe is an old version device, and its driver has been deleted in the new version of the certificate environment software (version >= 3.6.8)”. Concerning zfkeymonitor.exe, BJCA responded that their software did not include the zfkeymonitor program. ========================== Discussion Item #3: Clarification was requested about root certificate installation by the One Pass software. BJCA Response to Discussion Item #3: BJCA reiterated that their software did not attempt to install the two roots, but stated, “in order to improve the user experience, the BJCA certificate environment software chooses to skip user confirmation during the installation process, which may cause doubts for users. At present, we have plans to adopt advanced options in the new version of the software, allowing users to choose whether to confirm the installation, and support users to choose to add certificates and updates to the current user's personal storage instead of the computer's trusted root or trusted third party storage. No doubt that there is an obvious contradiction between convenience and security, which could improve the software security but degrades the user experience and increase our operation costs.” According to BJCA, it maintains two separate systems: a global, public-trust system that meets international standards (WebTrust, CA/Browser Forum, etc.) and issues and manages SSL/TLS server certificates; and a national system that follows Chinese standards and issues and manages personal certificates, enterprise certificates and equipment certificates (e.g., Beijing One Pass software and certificate). BJCA acknowledges that both systems are under control of the same legal business entity, but for the latter, the software is not part of the global, public-trust system. BJCA says it “will also refer to the recommendations of experts, learn from the best practices of the public trust system, continue to innovate, practice corporate social responsibility, and strive to build a safe and reliable of cyberspace.” ========================== Conclusion We thank community members for their review and consideration during this period. Root Store Programs will make final inclusion decisions independently, on their own timelines, and based on each Root Store Member’s inclusion criteria. Further discussion may take place in the independently managed Root Store community forums (i.e., MDSP).
dilyevsky 4y ago
A bit offtopic but how does one actually become a CA? Anyone has any good write ups on the costs and timeline involved?
- woodruffw 4y ago
  Anybody can become a CA; there’s no real cost. If you mean becoming a CA that browsers list in their trust roots: you need to obey the CA/B baseline requirements[1], which are reasonably onerous given the position of extraordinary trust it affords you. There are other requirements for other kinds of CAs as well (for example, codesigning in Windows). [1]: https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-1.8.6.pdf https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-...
  - notpushkin 4y ago
    And there's also a bunch of CAs grandfathered in the trust lists from the time there were less strict requirements. I think those are the CAs that we now see being yanked.
    - dilyevsky 4y ago
      Aren’t they 10y max? I’d assume all the old ones are expired now
      - toast0 4y ago
        I feel like a lot of older CAs all expire around 2038, but those might have been 1024-bit and purged.
    - toast0 4y ago
      I think they've still got to do audits and what not, but following the rules and stuff isn't sufficient to get in the trust stores (and isn't sufficient to stay either; nothing in this case really has anything to do with the guidelines). You also need to have some reason for browsers to care about your certs. Being available and interested in the 90s was good enough, but these days the route is probably pay an existing CA to cross sign your CA (which requires that you follow all the same rules as if you were in the trust stores), wait for usage, and then apply to be in direct.
pkoird 4y ago
> oh shit it's hacker news I've heard that people from the orange VC site are linking to this post! You are absolutely not welcome here. Cohost is not a place for you. you are bad and you hang out with white supremacists. please leave. Is this an attempt at humor (in which case, I don't get it), or is the author serious?
- krapp 4y ago
  Are you being purposely obtuse or are you unaware of the reputation of this community outside of this forum? They're likely serious.
  - ipcress_file 4y ago
    I am unaware. This place seems generally fine to me. Certainly no worse than others.
    - deleted 4y ago
      [deleted]
  - Exuma 4y ago
    [flagged]
    - vore 4y ago
      Hmm. Maybe comments like this are why the author doesn't like HN.
      - Exuma 4y ago
        Or maybe the author is overly offended at even the slightest things, especially considering HN is like the least toxic community I can think of.. except maybe a fountain pen forum.
    - nkozyra 4y ago
      Well that oughta clear up the reputation.
cyanydeez 4y ago
[flagged]
sirmike_ 4y ago
[flagged]
deleted 4y ago
[deleted]
- deleted 4y ago
  [deleted]
bloopj 4y ago
[flagged]
teddyh 4y ago
> The conclusion on the mailing list was roughly: look, we're not here to find you guilty in a court of law, we're here to decide whether we trust you, and after all that we definitely don't. I get the same feeling when I read the paroxysm about HN at the top of the page.
- snapplebobapple 4y ago
  Just imagine how i feel, i read the comments here because you guys tend to be fairly leftie ranging to too far leftie for me while leaning more libertarian to the point that you guys mostly get why individual liberty is the most important part of a high functioning society. That usually means i get the best version of the argument i disagree with while keeping the collectivist i sanity to a dull roar. Only finding out now that i have been doing conservatism wrong by not also holding white people in high regard has been jarring......
- teddyh 4y ago
  For reference, here’s how it looked: https://web.archive.org/web/20230120013024/https://cohost.org/arborelia/post/868933-how-to-destroy-a-cer https://web.archive.org/web/20230120013024/https://cohost.or...
deleted 4y ago
[deleted]
puffoflogic 4y ago
Re the "oh shit it's hacker news" edit: TIL dang is a white supremacist.
deleted 4y ago
[deleted]
KyleBerezin 4y ago
I just read the inquiry linked in this article. Trustcor has made a statement after the result of this inquiry. https://trustcor.com/news/12012022.php https://trustcor.com/news/12012022.php I seem to find myself much more on the fence about this topic than the average person, but I will say I think the correct decision was made. No doubt can exist about a CA's trustworthiness. From what I gathered there are some serious unaddressed issues. -The email system provided by Trustcor is NOT e2ee. By default the mail-service DOES allow trustcor the possibility of viewing the email, which is in direct contradiction to their documentation. -They claim the closest association trustcor had to magsafe was "shareholders of shareholders" but given their own statements this seems to be misleading, if not completely false. (correct me if I am wrong) They say that they are no worse than other CAs and their downfall was due to the attention the process attracted and liken it to "...a public interrogation held in a town square." I think I agree, but I also think that maybe this level of investigation should be more common.

276 points by JoshTriplett 4y ago

Whats wrong with that person?

This is a good summary of events, and the finishing of the article with that last sentence makes it a worthy read. "Saying that would have gotten her company destroyed even faster, but I think she would have been right." If you are also a sucker for some fun internet drama, definitely follow the dev-security-policy@mozilla.org mailing list.

throw_a_grenade 4y ago
Sadly, just yesterday Kathleen changed settings to manual approval of all signups: https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/gINEG-n1R_M https://groups.google.com/a/mozilla.org/g/dev-security-polic... But yes, we who are already subscribed will enjoy the sporadic, but colourful drama that brews there.
- duskwuff 4y ago
  You can browse the archives through the Google Groups web interface without subscribing.
- teddyh 4y ago
  It’s readable via <nntp://news.gmane.io/gmane.comp.mozilla.devel.security-policy>
- themoonisachees 4y ago
  If you just want to read, the emails are readable on the web without being subscribed.

wolfgang42 4y ago

Previously on HN: Concerns about Trustcor (70 days ago, 36 comments): https://news.ycombinator.com/item?id=33541718 https://news.ycombinator.com/item?id=33541718 Mozilla moves to distrust the TrustCor CA (49 days ago, 64 comments): https://news.ycombinator.com/item?id=33813660 https://news.ycombinator.com/item?id=33813660 Mozilla, Microsoft yank TrustCor's root certificate authority (49 days ago, 354 comments): https://news.ycombinator.com/item?id=33810755 https://news.ycombinator.com/item?id=33810755 Linux Certificate Authority root stores have a too simple view of 'trust' (44 days ago, 118 comments): https://news.ycombinator.com/item?id=33876949 https://news.ycombinator.com/item?id=33876949 Being able to partially distrust a Certificate Authority is good (43 days ago, 14 comments): https://news.ycombinator.com/item?id=33890823 https://news.ycombinator.com/item?id=33890823

advisedwang 4y ago

> The conclusion on the mailing list was roughly: look, we're not here to find you guilty in a court of law, we're here to decide whether we trust you, and after all that we definitely don't. They weren't untrusted just because of the behaviour. A really important dimension is that TrustCor certificates were only being used for very limited purpose. The actual decision is a a cost vs benefit analysis from the point of view of internet users. Because there's so little benefit, it takes only very little untrustworthiness before the best course of action is to distrust.

throw_a_grenade 4y ago
The browsers constantly wield this argument, but I don't like it. It necessarily leads to centralisation of CAs and going back to old days of VeriSign. I don't think we should be going towards LE/ISRG being the only organisation allowed to issue certificates for "cost vs benefits analysis" of allowing other entities to issue certs. It would be a single point of failure and a massive target for various non-state and state actors.
- lolinder 4y ago
  I agree in general, but in this case it was pretty clear-cut: TrustCor was a CA primarily to serve a single product, MsgSafe.io. This is the same product that was found to have bundled the only known unobfuscated Measurement Systems malware and was also found to be claiming E2E encryption when very rudimentary tests showed they couldn't possibly be encrypting the email. Since their only known benefit was issuing certificates in support of a quite-possibly-shady email system, I'm comfortable with saying that the cost-benefit analysis comes down firmly against TrustCor.
  - mewse 4y ago
    The "the only product known to have embedded unobfuscated Measurement Systems malware" phrase got used a whole lot, in the OP and in comments here as well as in the original email thread, but nobody really explained why that factor was important (or maybe I just missed it?) Can somebody explain the significance of the malware being unobfuscated, and why that's apparently more concerning than if it had been obfuscated?

ipaddr 4y ago

This is why we saw the huge push to https. Google developers being able to control who is allowed to issue a certificate might have worked well in 2004 but not now.

deleted 4y ago
[deleted]

blibble 4y ago

the thread in question: https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ https://groups.google.com/a/mozilla.org/g/dev-security-polic... really quite amazing to read the whataboutism starts about 50% of the way down

babelfish 4y ago
HN thread from that time https://news.ycombinator.com/item?id=33813660 https://news.ycombinator.com/item?id=33813660

woodruffw 4y ago

I think the final claim is amusing and thought provoking, but maybe not actually true: getting hellbanned by browsers is extremely visible, and I don’t think merely being critical of Google (even in disparaging language) would result in them risking their appearance of impartiality.

TheDong 4y ago
I believe the suggestion is not to _just_ say "google is an adware company". It's to say "sure we shipped spyware to android, we're guilty of what we are accused of, but google does it too and steals all the same information, but from even more people" > I don’t think merely being critical of Google (even in disparaging language) would result in them risking their appearance of impartiality. But saying "yes, we shipped the malware you claim we did" would have gotten them removed quickly, which is again what I think the actual suggestion was.
- woodruffw 4y ago
  That's a finer point, sure, but I don't think anybody operates under the pretense that (1) Google is not an advertising and analytics company, or that (2) Google willfully introduces malware to end user devices (even if their actual software could be reasonably characterized as adware or spyware).

akira2501 4y ago

I don't understand the argument. Imply without data that 90% of a mailing list works for Google, and further imply that their involvement with an open standard is actually a ploy to secretly benefit their advertising business? That doesn't seem very much like a "high road" to me.

calibas 4y ago
> Imply without data that 90% of a mailing list works for Google... Not what the article says. Here's the exact statement: "most of the people on that mailing list work either for or with Google" > and further imply that their involvement with an open standard is actually a ploy to secretly benefit their advertising business Also not what the article says. It's implied there's a conflict of interest, which is true, but not some kind of secret ploy.

lolinder 4y ago

One thing not mentioned is that the TrustCor VP (Rachel McPherson) spent the entire discussion trying to distance TrustCor from MsgSafe, the product that was coming under scrutiny for bundling the malware and engaging in false advertising about its encryption. She repeatedly categorized MsgSafe as a distinct business unit "operated separately and independently from TrustCor CA" to try to insulate the CA from getting damaged by MsgSafe's obvious problems. One of the key factors in Mozilla's decision was that this supposed operational independence was a lie, because Rachel herself was the Director/VP of Operations for both business units [0]: > The same individual was responsible for the day to day operation of both TrustCor’s CA business and MsgSafe. They are listed on TrustCor’s website as the VP of TrustCor’s CA operations and the Director of Operations for MsgSafe. [2] > ... > [2] Rachel McPherson is listed as the Vice President of Operations, having “access-to and control-over the CA and CA Business Operations” in a company document submitted privately by Rachel to Mozilla. Press releases on TrustCor’s website list Rachel McPherson as MsgSafe.io’s Director of Operations, e.g. https://web.archive.org/web/20221108224150/https://trustcor https://web.archive.org/web/20221108224150/https://trustcor..... [0] https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ https://groups.google.com/a/mozilla.org/g/dev-security-polic...

ethbr0 4y ago
The bad taste this left in my mouth was the glee with which it was conducted. Delisting a CA is a thing you can do. It is a serious thing you can do. But the internet drama surrounding this, and some posts on the mailing list itself, were overly emotional. "Ha! We caught you! You damned executive, you!" is not exactly the tone with which I'd want to conduct weighty matters. It was like looking back into the early-90s, when pitchforks-and-torches-because-we-technically-can were the norm. I don't miss those days, and I'd thought the internet had grown up more. Apologies in advance for being the no-fun police, but we're talking about destroying a business. Even if it's a shitty business, run by shitty people, trying to do shitty things... just don't fucking dance. https://m.youtube.com/watch?v=0k5aVLi_yhM https://m.youtube.com/watch?v=0k5aVLi_yhM
- akerl_ 4y ago

btown 4y ago

From the article: > [Google is a] company that also distributes spyware, because they don't check what their ad customers are doing very well and let them run random JavaScript on random web pages. Is this true? While it's absolutely the case that websites have very little control over what ad content is displayed (see, for instance, the work of https://checkmyads.org/ https://checkmyads.org/), I don't think I've ever seen evidence that ad publishers, or anyone in that massive ecosystem, can inject arbitrary code, running in the browser's context, into websites who monetize through Google AdSense script tags alone. Of course, Google touches other parts of the pipeline, and I'm sure that in their trillions of transactions, they have unknowingly participated in or facilitated transactions that route/suggest malicious ads to other AdSense-like ad-embedding or tracking solutions that might have RCE vulnerabilities. But it seems a bit of a stretch to call this "distributing spyware," any more so that it is to call a customs official who misses an illegal package a smuggler.

EdwardDiego 4y ago
Every ad these days is 'spyware', despite the ineffectiveness of "personalized adverts". I worked for an SSP, and always loved the data we got back from DMPs categorising the same user into "segments". Sometimes they were a man, until five impressions later they weren't, the guesses at age varied significantly also. That said, none of those DMPs were Google. I believe that they'd actually be able to correctly segment you, because, well, it's Google, one of the companies putting the brightest minds of our generation to work on the problem of optimising CTR.
- b112 4y ago
  The idea that a family, a household, or even just roommates, with no gmail, no login to much of anything, might all use the same computer, or even share a tablet? Well, that must give people at google a conniption fit.
  - EdwardDiego 4y ago
    They can distinguish you based on some fingerprinting and, most importantly, browsing behavior. That's what FLoC was about - with enough data, you don't need third party cookies to recognise a user.

superkuh 4y ago

Now extend this by thinking about how HTTP/2 and HTTP/3 implementations in all major browsers (and the libs they use) don't allow you to establish a connection without a CA based TLS cert. It's going to make the already rocky CA/Browser/User triad even more fraught with dangers.

mattwilsonn888 4y ago
I would be interested in reading more if you cared to elaborate or provide some link(s).
woodruffw 4y ago
As far as I know, you can use a self-signed certificate with HTTP/2 in every major browser.

gzer0 4y ago

Naturally, this led me to research how does one even become a CA? * Developing and implementing a robust security infrastructure * Completing an application process * Undergoing an audit and validation process * Obtaining accreditation from a recognized organization * Maintaining compliance with accreditation requirements. and then: * On average, it can take several months to a year or more to complete the process of becoming a CA. This includes the time required for developing and implementing the necessary policies and procedures, completing the application process, undergoing the audit and validation process, and obtaining accreditation. Wow, throwing away several months to a year of effort. It truly is something that takes time. I guess, a determined adversary will play the long con.

kseifried 4y ago
Witness bjca.cn: https://groups.google.com/a/ccadb.org/g/public/c/o9lbCbr92Ug https://groups.google.com/a/ccadb.org/g/public/c/o9lbCbr92Ug The summary of the public discussion is worrying: Summary of Discussion and Action Items Discussion Item #1: A concern was raised about BJCA’s Beijing One Pass software, which apparently facilitates client access to a digital portal or platform. It was noted that BJCA had attempted to address suspicions about the software in Comment #15, that the software was needed to support a USB token and to install another certificate chain, and not the two above-referenced roots. A follow-up question was whether a security report concerning the software would be made publicly available. BJCA Response to Discussion Item #1: “This report is a communication document between our company and the competent government department, and it is not suitable for disclosure or submission to Mozilla because it involves confidential information. And because the security incident does not involve the certificate chain of the root inclusion case submitted to Mozilla this time, we made a clarification in the Mozilla root inclusion case by disclosing the main points of the report.” ========================== Discussion Item #2: Two components were also mentioned: wmControl.exe and zfkeymonitor.exe. BJCA Response to Discussion Item #2: The “suspected spyware behavior indicated in the report was caused by one of the drivers, wmControl.exe. This program is a driver provided by the USB Token manufacturer, Its software behavior is different from spyware and does not have malicious behavior. It is intended to ensure the normal use of this type of [device] in the browser. In addition, the USB Token for digital certificate corresponding to the driver wmControl.exe is an old version device, and its driver has been deleted in the new version of the certificate environment software (version >= 3.6.8)”. Concerning zfkeymonitor.exe, BJCA responded that their software did not include the zfkeymonitor program. ========================== Discussion Item #3: Clarification was requested about root certificate installation by the One Pass software. BJCA Response to Discussion Item #3: BJCA reiterated that their software did not attempt to install the two roots, but stated, “in order to improve the user experience, the BJCA certificate environment software chooses to skip user confirmation during the installation process, which may cause doubts for users. At present, we have plans to adopt advanced options in the new version of the software, allowing users to choose whether to confirm the installation, and support users to choose to add certificates and updates to the current user's personal storage instead of the computer's trusted root or trusted third party storage. No doubt that there is an obvious contradiction between convenience and security, which could improve the software security but degrades the user experience and increase our operation costs.” According to BJCA, it maintains two separate systems: a global, public-trust system that meets international standards (WebTrust, CA/Browser Forum, etc.) and issues and manages SSL/TLS server certificates; and a national system that follows Chinese standards and issues and manages personal certificates, enterprise certificates and equipment certificates (e.g., Beijing One Pass software and certificate). BJCA acknowledges that both systems are under control of the same legal business entity, but for the latter, the software is not part of the global, public-trust system. BJCA says it “will also refer to the recommendations of experts, learn from the best practices of the public trust system, continue to innovate, practice corporate social responsibility, and strive to build a safe and reliable of cyberspace.” ========================== Conclusion We thank community members for their review and consideration during this period. Root Store Programs will make final inclusion decisions independently, on their own timelines, and based on each Root Store Member’s inclusion criteria. Further discussion may take place in the independently managed Root Store community forums (i.e., MDSP).

dilyevsky 4y ago

A bit offtopic but how does one actually become a CA? Anyone has any good write ups on the costs and timeline involved?

woodruffw 4y ago
Anybody can become a CA; there’s no real cost. If you mean becoming a CA that browsers list in their trust roots: you need to obey the CA/B baseline requirements[1], which are reasonably onerous given the position of extraordinary trust it affords you. There are other requirements for other kinds of CAs as well (for example, codesigning in Windows). [1]: https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-1.8.6.pdf https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-...
- notpushkin 4y ago
  And there's also a bunch of CAs grandfathered in the trust lists from the time there were less strict requirements. I think those are the CAs that we now see being yanked.
  - dilyevsky 4y ago
    Aren’t they 10y max? I’d assume all the old ones are expired now
    - toast0 4y ago
      I feel like a lot of older CAs all expire around 2038, but those might have been 1024-bit and purged.
  - toast0 4y ago
    I think they've still got to do audits and what not, but following the rules and stuff isn't sufficient to get in the trust stores (and isn't sufficient to stay either; nothing in this case really has anything to do with the guidelines). You also need to have some reason for browsers to care about your certs. Being available and interested in the 90s was good enough, but these days the route is probably pay an existing CA to cross sign your CA (which requires that you follow all the same rules as if you were in the trust stores), wait for usage, and then apply to be in direct.

pkoird 4y ago

> oh shit it's hacker news I've heard that people from the orange VC site are linking to this post! You are absolutely not welcome here. Cohost is not a place for you. you are bad and you hang out with white supremacists. please leave. Is this an attempt at humor (in which case, I don't get it), or is the author serious?

krapp 4y ago
Are you being purposely obtuse or are you unaware of the reputation of this community outside of this forum? They're likely serious.
- ipcress_file 4y ago
  I am unaware. This place seems generally fine to me. Certainly no worse than others.
  - deleted 4y ago
    [deleted]
- Exuma 4y ago
  [flagged]
  - vore 4y ago
    Hmm. Maybe comments like this are why the author doesn't like HN.
    - Exuma 4y ago
      Or maybe the author is overly offended at even the slightest things, especially considering HN is like the least toxic community I can think of.. except maybe a fountain pen forum.
  - nkozyra 4y ago
    Well that oughta clear up the reputation.

cyanydeez 4y ago

[flagged]

sirmike_ 4y ago

[flagged]

deleted 4y ago

[deleted]

deleted 4y ago
[deleted]

bloopj 4y ago

[flagged]

teddyh 4y ago

snapplebobapple 4y ago
Just imagine how i feel, i read the comments here because you guys tend to be fairly leftie ranging to too far leftie for me while leaning more libertarian to the point that you guys mostly get why individual liberty is the most important part of a high functioning society. That usually means i get the best version of the argument i disagree with while keeping the collectivist i sanity to a dull roar. Only finding out now that i have been doing conservatism wrong by not also holding white people in high regard has been jarring......
teddyh 4y ago
For reference, here’s how it looked: https://web.archive.org/web/20230120013024/https://cohost.org/arborelia/post/868933-how-to-destroy-a-cer https://web.archive.org/web/20230120013024/https://cohost.or...

deleted 4y ago

[deleted]

puffoflogic 4y ago

Re the "oh shit it's hacker news" edit: TIL dang is a white supremacist.

deleted 4y ago

[deleted]

KyleBerezin 4y ago

I just read the inquiry linked in this article. Trustcor has made a statement after the result of this inquiry. https://trustcor.com/news/12012022.php https://trustcor.com/news/12012022.php I seem to find myself much more on the fence about this topic than the average person, but I will say I think the correct decision was made. No doubt can exist about a CA's trustworthiness. From what I gathered there are some serious unaddressed issues. -The email system provided by Trustcor is NOT e2ee. By default the mail-service DOES allow trustcor the possibility of viewing the email, which is in direct contradiction to their documentation. -They claim the closest association trustcor had to magsafe was "shareholders of shareholders" but given their own statements this seems to be misleading, if not completely false. (correct me if I am wrong) They say that they are no worse than other CAs and their downfall was due to the attention the process attracted and liken it to "...a public interrogation held in a town square." I think I agree, but I also think that maybe this level of investigation should be more common.