5 ms·

This is a bad look. I expected the result would be Chrome and Firefox dropping trust for this CA, but they already don't trust this CA. Arguably, Microsoft/Wind

This is a bad look. I expected the result would be Chrome and Firefox dropping trust for this CA, but they already don't trust this CA. Arguably, Microsoft/Windows trusting a CA that the other big players choose not to trust is an even worse look for Microsoft.

move-on-by 2y ago
Also being issued on a major US holiday- when many are on PTO- does not help with the look.
- alganet 2y ago
  During carnival we brazillians often take 3 or 4 days leave. Would it be fair during that time if I asked you to hold your PRs, bug tickets and work in general because we're on paid leave? On-call rotation exists for those reasons. Otherwise, all countries would need to respect all other countries holidays. In fact, we're not even aware of most US holidays. It is likely to be a coincidence.
  - lmm 2y ago
    > Would it be fair during that time if I asked you to hold your PRs, bug tickets and work in general because we're on paid leave? Yes. That's completely normal for companies that do business with Brazil.
    - alganet 2y ago
      Sorry, my example was bad. In fact, your example is perfect. We're not talking about business. CAs are different. In security and infrastructure, there's always someone working on holidays. The larger the organization, higher are the chances that some kind of rotation exists.
  - bogota 2y ago
    Have you never worked at a multinational company?
    - alganet 2y ago
      I did, multiple times with multiple countries. All of them had some sort of call rotation. Someone was always at the helm, _specially_ in infrastructure and security. There are whole startups designed to solve this, like PagerDuty. I am now very curious to understand where your question comes from. There must be some misunderstanding here. You never went on-call or seen a friend do it?
      - JumpCrisscross 2y ago
        > You never went on-call or seen a friend do it? Red herring [1]. OP said it’s malicious or incompetent to release this on a U.S. holiday weekend. You asked if similar consideration would be given to Brazil. Multiple people chimed in that it would. You’re now pivoting to on-call capacity. Any amount of on-call capacity can be saturated. That’s why competent multinationals avoid releasing while markets they’re likely to impact are sleeping or drunk. This is a high-level scheduling operation, however, so it’s reasonable for those lower in the organisation to be unaware why an update is being pushed next Tuesday instead of this. [1] https://en.m.wikipedia.org/wiki/Red_herring https://en.m.wikipedia.org/wiki/Red_herring
        alganet 2y ago
        You can totally ignore the red herring and focus on the first part. In the end I was just paraphrasing the comment I replied to. Rotations exist, specially in large organizations, or when there's shared responsibility. Now we're talking nonsense about "you said, he said", this conversation makes no sense. I am much less invested in this than you think.
        JumpCrisscross 2y ago
        > Rotations exist Straw man [1]. Nobody claimed otherwise. Rotation or always-on isn’t a substitute for being aware of your customers. Good culture permeate this throughout the organisation. Competent ones have someone at the top ensuring controls are followed. [1] https://en.m.wikipedia.org/wiki/Straw_man https://en.m.wikipedia.org/wiki/Straw_man
  - noirbot 2y ago
    For as big a country as Brazil? Totally. I've worked at companies that had minor code freezes for all sorts of holidays in countries we had a big client presence in, specifically to avoid releasing changes to client that wouldn't have engineers in-office to adapt to them.
  - JumpCrisscross 2y ago
    > we're not even aware of most US holidays You’re not. Someone above you should be. Otherwise that’s incompetence.
  - move-on-by 2y ago
    My comment is not about how all work should stop during US holidays. What I’m attempting to refer to, is that _if_ this was done with malicious intent, then maybe the hope was that doing it during a holiday would reduce response time or allow it to fly under the radar. Of course, as you say, just because it was a holiday does not inherently mean it’s malicious, it has plausible deniability.
    - alganet 2y ago
      What I actually said is that I believe that the notion of a holiday "hiding" these activities is naive. I don't think it makes any difference. I don't know if there's a rotation or another system. I think there are probably multiple across different parties responsible for maintaining CA trust.
  - deleted 2y ago
    [deleted]
jsheard 2y ago
What is even the point of a web CA that isn't trusted by all of the major players? Is there one?
- beeflet 2y ago
  I suppose it allows you to enable third party control and censorship. If you look at microsoft's censorship of bing in china for example, they are more than willing to bend the knee if it means they can get ahead.
  - alganet 2y ago
    As a brazillian, I find this very unlikely. In 2013, when the same party was in power, SERPRO was tasked with replacing Microsoft in key aspects, such as government email (which was handled by Outlook Server at that time) and operating systems. The main reason was fear of espionage. So, in reality, we are more afraid of the US spying on us than random internet dissidents.
    - serial_dev 2y ago
      As a non Brazilian, sometimes when a government says a company is spying on its citizens, they mean that they want access, too, to the spying and censoring apparatus.
      - alganet 2y ago
        I see your point. Maybe if I was in government I would think the same. Catch criminals before they act, stuff like that (I'm just being the devil's advocate here). This is a dillema, and the worst kind. The kind citizens know nothing about, so the only possible way to talk about it is to speculate. I am, however, too old to speculate about these things anymore.
- tialaramex 2y ago
  These are generally government CAs, so, typically the situation is Microsoft sold the government Windows, and as part of that deal (at least tacitly) agreed to the CA being trusted, and so every system that's trusting these certificates is a Windows PC anyway, running Edge because the whole point was the government will only use Windows and pays Microsoft $$$. Why bake it into everybody else's Windows? If you make say a Brazil Government-only Windows which trusts this CA instead, I guarantee somebody crucial in Brazil will buy a 3rd party Windows laptop independently and it doesn't work with this CA's certificates and that ends up as Microsoft's problem to fix, so, easier to just have every Windows device trust the CA. They'll have an assurance from the CA that it won't do this sort of crap, and that's enough, plausible deniability. Microsoft will say they take this "very seriously" and do nothing and it'll blow over. After all this stuff happened before and it'll happen again, and Windows will remain very popular.
beeflet 2y ago
It's not just a bad look, it's bad period.
deleted 2y ago
[deleted]
lokar 2y ago
Microsoft is all about bad looks
raincole 2y ago
How bad is it? (Genuine question from me who lacks cybersecurity knowledge)
- retrodaredevil 2y ago
  Let's assume that some malicious third party has control of the certificate that was created by this fishy CA. The main attack that they could carry out is a man in the middle (MitM) attack. This attack requires this malicious third party to be able to intercept and change the contents of requests being sent to google.com and someone's web browser. A MitM attack can be easily carried out by someone in control of an ISP, or someone in control of a WiFi network. So, if you trust your ISP and your WiFi network, realistically you have nothing to worry about. The reason that this issued certificate could allow an attack like this to happen is because all websites nowadays use HTTPS connections, and certificate authorities are the entities that tell your web browser that certain certificates are legit. They confirm that a website is actually that website. If you visit some website and someone tries to do a MitM attack between your web browser and that website, the web page should fail to load because if they try to change the certificate, your web browser should reject it because it is invalid.
- bawolff 2y ago
  Well now that everyone knows about it, its a whole lot less bad. The bad certificate was caught, and caught quickly. The system works. It is a bit like if airport security catches someone who wanted to bomb a plane. Yes the immediate gut reaction is that is terrible, but if you think about it for a bit its actually reassuring, since its proof the safe guards worked.
justinclift 2y ago
> an even worse look for Microsoft. Microsoft have a terrible reputation for security, which they've earned through doing stuff like this. It's not likely to get any better any time soon either, as their trajectory is still pointed downwards.
- danpalmer 2y ago
  I don’t know enough to comment on that reputation, but this surprises me. They’re known for being great at serving and selling to the enterprise, frequently at the expense of end users, and big enterprises/govts care a lot about security usually. Even if much of that caring is box ticking rather than actually looking into the security (hello ISO27001), you’d expect it to result in generally a security conscious culture.
  - outworlder 2y ago
    It's hit and miss. They have one of the largest cyber security operations worldwide and regularly track and dismantle criminal operations. There's some great people working there. Then there's Azure. Which is used by large organizations and you would expect it to have the utmost care when it comes to security. But it often does badly, in several instances it allowed different tenants to access information from one another, something unheard of on AWS. For example: https://www.securityweek.com/microsoft-patches-azure-cross-tenant-data-access-flaw/ https://www.securityweek.com/microsoft-patches-azure-cross-t... or https://www.theregister.com/2024/06/05/tenable_azure_flaw/ https://www.theregister.com/2024/06/05/tenable_azure_flaw/ or https://borncity.com/win/2023/08/03/microsoft-as-a-security-risk-azure-vulnerability-unpatched-since-march-2023-heavy-criticism-from-tenable-part-2/ https://borncity.com/win/2023/08/03/microsoft-as-a-security-... There are so many cross tenant vulnerabilities that there could be some overlap in those URLs, and it's a bit late at night for me to read those carefully, but you get the idea. They do get the most flak about Windows, which used to be a non networked, single user OS.
  - cassianoleal 2y ago
    > Even if much of that caring is box ticking rather than actually looking into the security (hello ISO27001), you’d expect it to result in generally a security conscious culture. If the whole value is in ticking the box, why would that develop a culture that values anything more than the tick?
jowea 2y ago
Funny thing is this is just the latest issue around this CA. For a long time you had to manually add it to certificate store because it was not trusted by default but the Brazilian government insisted in using it on official websites.

move-on-by 2y ago

Also being issued on a major US holiday- when many are on PTO- does not help with the look.

alganet 2y ago
During carnival we brazillians often take 3 or 4 days leave. Would it be fair during that time if I asked you to hold your PRs, bug tickets and work in general because we're on paid leave? On-call rotation exists for those reasons. Otherwise, all countries would need to respect all other countries holidays. In fact, we're not even aware of most US holidays. It is likely to be a coincidence.
- lmm 2y ago
  > Would it be fair during that time if I asked you to hold your PRs, bug tickets and work in general because we're on paid leave? Yes. That's completely normal for companies that do business with Brazil.
  - alganet 2y ago
    Sorry, my example was bad. In fact, your example is perfect. We're not talking about business. CAs are different. In security and infrastructure, there's always someone working on holidays. The larger the organization, higher are the chances that some kind of rotation exists.
- bogota 2y ago
  Have you never worked at a multinational company?
  - alganet 2y ago
    I did, multiple times with multiple countries. All of them had some sort of call rotation. Someone was always at the helm, _specially_ in infrastructure and security. There are whole startups designed to solve this, like PagerDuty. I am now very curious to understand where your question comes from. There must be some misunderstanding here. You never went on-call or seen a friend do it?
    - JumpCrisscross 2y ago
      > You never went on-call or seen a friend do it? Red herring [1]. OP said it’s malicious or incompetent to release this on a U.S. holiday weekend. You asked if similar consideration would be given to Brazil. Multiple people chimed in that it would. You’re now pivoting to on-call capacity. Any amount of on-call capacity can be saturated. That’s why competent multinationals avoid releasing while markets they’re likely to impact are sleeping or drunk. This is a high-level scheduling operation, however, so it’s reasonable for those lower in the organisation to be unaware why an update is being pushed next Tuesday instead of this. [1] https://en.m.wikipedia.org/wiki/Red_herring https://en.m.wikipedia.org/wiki/Red_herring
      - alganet 2y ago
        You can totally ignore the red herring and focus on the first part. In the end I was just paraphrasing the comment I replied to. Rotations exist, specially in large organizations, or when there's shared responsibility. Now we're talking nonsense about "you said, he said", this conversation makes no sense. I am much less invested in this than you think.
        JumpCrisscross 2y ago
        > Rotations exist Straw man [1]. Nobody claimed otherwise. Rotation or always-on isn’t a substitute for being aware of your customers. Good culture permeate this throughout the organisation. Competent ones have someone at the top ensuring controls are followed. [1] https://en.m.wikipedia.org/wiki/Straw_man https://en.m.wikipedia.org/wiki/Straw_man
- noirbot 2y ago
  For as big a country as Brazil? Totally. I've worked at companies that had minor code freezes for all sorts of holidays in countries we had a big client presence in, specifically to avoid releasing changes to client that wouldn't have engineers in-office to adapt to them.
- JumpCrisscross 2y ago
  > we're not even aware of most US holidays You’re not. Someone above you should be. Otherwise that’s incompetence.
- move-on-by 2y ago
  My comment is not about how all work should stop during US holidays. What I’m attempting to refer to, is that _if_ this was done with malicious intent, then maybe the hope was that doing it during a holiday would reduce response time or allow it to fly under the radar. Of course, as you say, just because it was a holiday does not inherently mean it’s malicious, it has plausible deniability.
  - alganet 2y ago
    What I actually said is that I believe that the notion of a holiday "hiding" these activities is naive. I don't think it makes any difference. I don't know if there's a rotation or another system. I think there are probably multiple across different parties responsible for maintaining CA trust.
- deleted 2y ago
  [deleted]

jsheard 2y ago

What is even the point of a web CA that isn't trusted by all of the major players? Is there one?

beeflet 2y ago
I suppose it allows you to enable third party control and censorship. If you look at microsoft's censorship of bing in china for example, they are more than willing to bend the knee if it means they can get ahead.
- alganet 2y ago
  As a brazillian, I find this very unlikely. In 2013, when the same party was in power, SERPRO was tasked with replacing Microsoft in key aspects, such as government email (which was handled by Outlook Server at that time) and operating systems. The main reason was fear of espionage. So, in reality, we are more afraid of the US spying on us than random internet dissidents.
  - serial_dev 2y ago
    As a non Brazilian, sometimes when a government says a company is spying on its citizens, they mean that they want access, too, to the spying and censoring apparatus.
    - alganet 2y ago
      I see your point. Maybe if I was in government I would think the same. Catch criminals before they act, stuff like that (I'm just being the devil's advocate here). This is a dillema, and the worst kind. The kind citizens know nothing about, so the only possible way to talk about it is to speculate. I am, however, too old to speculate about these things anymore.
tialaramex 2y ago
These are generally government CAs, so, typically the situation is Microsoft sold the government Windows, and as part of that deal (at least tacitly) agreed to the CA being trusted, and so every system that's trusting these certificates is a Windows PC anyway, running Edge because the whole point was the government will only use Windows and pays Microsoft $$$. Why bake it into everybody else's Windows? If you make say a Brazil Government-only Windows which trusts this CA instead, I guarantee somebody crucial in Brazil will buy a 3rd party Windows laptop independently and it doesn't work with this CA's certificates and that ends up as Microsoft's problem to fix, so, easier to just have every Windows device trust the CA. They'll have an assurance from the CA that it won't do this sort of crap, and that's enough, plausible deniability. Microsoft will say they take this "very seriously" and do nothing and it'll blow over. After all this stuff happened before and it'll happen again, and Windows will remain very popular.

beeflet 2y ago

It's not just a bad look, it's bad period.

deleted 2y ago

[deleted]

lokar 2y ago

Microsoft is all about bad looks

raincole 2y ago

How bad is it? (Genuine question from me who lacks cybersecurity knowledge)

retrodaredevil 2y ago
Let's assume that some malicious third party has control of the certificate that was created by this fishy CA. The main attack that they could carry out is a man in the middle (MitM) attack. This attack requires this malicious third party to be able to intercept and change the contents of requests being sent to google.com and someone's web browser. A MitM attack can be easily carried out by someone in control of an ISP, or someone in control of a WiFi network. So, if you trust your ISP and your WiFi network, realistically you have nothing to worry about. The reason that this issued certificate could allow an attack like this to happen is because all websites nowadays use HTTPS connections, and certificate authorities are the entities that tell your web browser that certain certificates are legit. They confirm that a website is actually that website. If you visit some website and someone tries to do a MitM attack between your web browser and that website, the web page should fail to load because if they try to change the certificate, your web browser should reject it because it is invalid.
bawolff 2y ago
Well now that everyone knows about it, its a whole lot less bad. The bad certificate was caught, and caught quickly. The system works. It is a bit like if airport security catches someone who wanted to bomb a plane. Yes the immediate gut reaction is that is terrible, but if you think about it for a bit its actually reassuring, since its proof the safe guards worked.

justinclift 2y ago

> an even worse look for Microsoft. Microsoft have a terrible reputation for security, which they've earned through doing stuff like this. It's not likely to get any better any time soon either, as their trajectory is still pointed downwards.

danpalmer 2y ago
I don’t know enough to comment on that reputation, but this surprises me. They’re known for being great at serving and selling to the enterprise, frequently at the expense of end users, and big enterprises/govts care a lot about security usually. Even if much of that caring is box ticking rather than actually looking into the security (hello ISO27001), you’d expect it to result in generally a security conscious culture.
- outworlder 2y ago
  It's hit and miss. They have one of the largest cyber security operations worldwide and regularly track and dismantle criminal operations. There's some great people working there. Then there's Azure. Which is used by large organizations and you would expect it to have the utmost care when it comes to security. But it often does badly, in several instances it allowed different tenants to access information from one another, something unheard of on AWS. For example: https://www.securityweek.com/microsoft-patches-azure-cross-tenant-data-access-flaw/ https://www.securityweek.com/microsoft-patches-azure-cross-t... or https://www.theregister.com/2024/06/05/tenable_azure_flaw/ https://www.theregister.com/2024/06/05/tenable_azure_flaw/ or https://borncity.com/win/2023/08/03/microsoft-as-a-security-risk-azure-vulnerability-unpatched-since-march-2023-heavy-criticism-from-tenable-part-2/ https://borncity.com/win/2023/08/03/microsoft-as-a-security-... There are so many cross tenant vulnerabilities that there could be some overlap in those URLs, and it's a bit late at night for me to read those carefully, but you get the idea. They do get the most flak about Windows, which used to be a non networked, single user OS.
- cassianoleal 2y ago
  > Even if much of that caring is box ticking rather than actually looking into the security (hello ISO27001), you’d expect it to result in generally a security conscious culture. If the whole value is in ticking the box, why would that develop a culture that values anything more than the tick?

jowea 2y ago

Funny thing is this is just the latest issue around this CA. For a long time you had to manually add it to certificate store because it was not trusted by default but the Brazilian government insisted in using it on official websites.