3 ms·
What if it's the trusted Root CAs who are giving state agencies copies of their signing keys thus allowing them to sign valid certificates to impersonate anyone
by reedlaw 13y ago
What if it's the trusted Root CAs who are giving state agencies copies of their signing keys thus allowing them to sign valid certificates to impersonate anyone?
- marshray 13y agoThat would likely work for targeted attacks against browsers other than Chrome (and maybe recent FF, I'm not sure) but not for large scale dragnet attacks.
- reedlaw 13y agoWhy wouldn't it affect Chrome if the Root CA is trusted by Chrome? According to http://www.chromium.org/Home/chromium-security/root-ca-policy http://www.chromium.org/Home/chromium-security/root-ca-polic... they use the underlying OS list except in the case of Linux in which they use Mozilla's list.
- jmesserly 13y agoChrome has certificate pinning, see http://blog.chromium.org/2011/06/new-chromium-security-features-june.html http://blog.chromium.org/2011/06/new-chromium-security-featu...: "In addition in Chromium 13, only a very small subset of CAs have the authority to vouch for Gmail (and the Google Accounts login page). This can protect against recent incidents where a CA has its authority abused, and generally protects against the proliferation of signing authority." (disclaimer: I work for Chrome but not on these features.)