5 ms·

Not clear (to me) in the original post -- was this done accidentally or intentionally?

by noitpmeder 2y ago

fguerraz 2y ago
Carelessly is the answer
ruined 2y ago
does that matter?
- altairprime 2y ago
  Yes; malice is indefensible no matter the circumstances, mistakes may be defensible under certain circumstances or with certain responses by the mistakee.
  - sabbaticaldev 2y ago
    as a brazilian i’m not sure if I’d prefer it to be malice or incompetence
    - lazide 2y ago
      There is also the option of malicious incompetence, of course.
    - griomnib 2y ago
      As an American…why not both?
    - altairprime 2y ago
      Incompetence: operating a CA is difficult enough that sometimes people fuck up, but if the CA is corrupted, then that’s much worse.
tptacek 2y ago
The certificate was registered in CT, so a reasonable assumption would be that this was accidental, because it was guaranteed to be noticed and to generate drama that would threaten the capability they arranged, presumably at some significant expense.
- px43 2y ago
  What is CT here? Central Time? Connecticut? Maybe Certificate Transparency? I guess that last one might make the most sense. Abbreviations are hard.
  - FergusArgyll 2y ago
    Computed Tomography?
  - bart__ 2y ago
    Certificate Transparency, all CA's log their issued certificates to central log servers, managed by Cloudflare, google etc. If this is not done, the certificate will not be seen as trusted by Browsers. It was designed to have a publicly auditable source of issued certificates, exactly so we can notice rogue google.com certs.
    - tialaramex 2y ago
      Technically you don't have to log certificates during issuance, and actually doing so is slightly more trouble (because of a chicken & egg problem, you want the log proof in the certificate, so you must log special "poisoned" certificates to get that proof and then fasten that proof to the certificate. A customer can take an unlogged cert, log it themselves, and then use the certificate and the separate proof of logging they received and use that just fine. Google have some services which do this. One clever thing this enables is you can buy the cert secret-product-name.example, unlogged, build the web site, check everything works, and log the certificate seconds before the product launch event, so snoops can't tell your new product is secret-product-name until the moment you announce it, yet the site works immediately. I have very rarely seen this done but it's possible. When there's an ordinary White House transition process both plausible transition site certs get logged, even though in practice one of those sites is never published. Since Trump I have no idea if this process is so smooth any more. A CA can choose whether to have this "issue unlogged certs" process as something they offer, it's a niche thing, but it could make sense. They need to keep adequate records of every certificate they issue (that's required) and logging is a very easy way to satisfy that requirement, but it's not the only way. In practice, the logged certificates are the easy consumer option, like selling ready-to-eat food in a deli. Some customers might be prepared to buy ingredients and go away to make food, but, many customers probably want to eat food immediately so for extra money you sell products that can just be eaten immediately. So, yes, the vast majority of certificates issued every day are indeed logged immediately so as to provide the product people want.
woodson 2y ago
As a CA, how does one accidentally issue a certificate for google.com? I mean, is there a scenario that isn't malicious?
- tptacek 2y ago
  Yes, if the interception system involved was meant only for resources within Brazil’s own agency networks.
  - lxgr 2y ago
    But that's not allowed for publicly trusted roots under any circumstances, right? Not sure if that would qualify as an accident.
    - foota 2y ago
      I think the parent is saying that if they meant to use the cert only internally (e.g., to monitor employees) then that would arguably not be malicious.
      - lxgr 2y ago
        Not malicious, but also not exactly purely accidental, i.e. as part of some otherwise totally legitimate activity.
        foota 2y ago
        I think the accidental part would be in the scope. I'm not an expert on these things, but they could have intended to create a self signed cert only valid within the scope of their IT, but accidentally created one from their CA.
      - grayhatter 2y ago
        > (e.g., to monitor employees) then that would arguably not be malicious. If only there was a way to monitor company equipment without issuing a cert for a public 3rd party.

Not clear (to me) in the original post -- was this done accidentally or intentionally?

fguerraz 2y ago

Carelessly is the answer

ruined 2y ago

does that matter?

altairprime 2y ago
Yes; malice is indefensible no matter the circumstances, mistakes may be defensible under certain circumstances or with certain responses by the mistakee.
- sabbaticaldev 2y ago
  as a brazilian i’m not sure if I’d prefer it to be malice or incompetence
  - lazide 2y ago
    There is also the option of malicious incompetence, of course.
  - griomnib 2y ago
    As an American…why not both?
  - altairprime 2y ago
    Incompetence: operating a CA is difficult enough that sometimes people fuck up, but if the CA is corrupted, then that’s much worse.

tptacek 2y ago

The certificate was registered in CT, so a reasonable assumption would be that this was accidental, because it was guaranteed to be noticed and to generate drama that would threaten the capability they arranged, presumably at some significant expense.

px43 2y ago
What is CT here? Central Time? Connecticut? Maybe Certificate Transparency? I guess that last one might make the most sense. Abbreviations are hard.
- FergusArgyll 2y ago
  Computed Tomography?
- bart__ 2y ago
  Certificate Transparency, all CA's log their issued certificates to central log servers, managed by Cloudflare, google etc. If this is not done, the certificate will not be seen as trusted by Browsers. It was designed to have a publicly auditable source of issued certificates, exactly so we can notice rogue google.com certs.
  - tialaramex 2y ago
    Technically you don't have to log certificates during issuance, and actually doing so is slightly more trouble (because of a chicken & egg problem, you want the log proof in the certificate, so you must log special "poisoned" certificates to get that proof and then fasten that proof to the certificate. A customer can take an unlogged cert, log it themselves, and then use the certificate and the separate proof of logging they received and use that just fine. Google have some services which do this. One clever thing this enables is you can buy the cert secret-product-name.example, unlogged, build the web site, check everything works, and log the certificate seconds before the product launch event, so snoops can't tell your new product is secret-product-name until the moment you announce it, yet the site works immediately. I have very rarely seen this done but it's possible. When there's an ordinary White House transition process both plausible transition site certs get logged, even though in practice one of those sites is never published. Since Trump I have no idea if this process is so smooth any more. A CA can choose whether to have this "issue unlogged certs" process as something they offer, it's a niche thing, but it could make sense. They need to keep adequate records of every certificate they issue (that's required) and logging is a very easy way to satisfy that requirement, but it's not the only way. In practice, the logged certificates are the easy consumer option, like selling ready-to-eat food in a deli. Some customers might be prepared to buy ingredients and go away to make food, but, many customers probably want to eat food immediately so for extra money you sell products that can just be eaten immediately. So, yes, the vast majority of certificates issued every day are indeed logged immediately so as to provide the product people want.

woodson 2y ago

As a CA, how does one accidentally issue a certificate for google.com? I mean, is there a scenario that isn't malicious?

tptacek 2y ago
Yes, if the interception system involved was meant only for resources within Brazil’s own agency networks.
- lxgr 2y ago
  But that's not allowed for publicly trusted roots under any circumstances, right? Not sure if that would qualify as an accident.
  - foota 2y ago
    I think the parent is saying that if they meant to use the cert only internally (e.g., to monitor employees) then that would arguably not be malicious.
    - lxgr 2y ago
      Not malicious, but also not exactly purely accidental, i.e. as part of some otherwise totally legitimate activity.
      - foota 2y ago
        I think the accidental part would be in the scope. I'm not an expert on these things, but they could have intended to create a self signed cert only valid within the scope of their IT, but accidentally created one from their CA.
    - grayhatter 2y ago
      > (e.g., to monitor employees) then that would arguably not be malicious. If only there was a way to monitor company equipment without issuing a cert for a public 3rd party.