4 ms·

Well since the GCHQ is part of the government, and the government has a root cert in the browsers, they can basically create all the SSL certificates they want.

Well since the GCHQ is part of the government, and the government has a root cert in the browsers, they can basically create all the SSL certificates they want. Governments can MITM without any problems.

__alexs 13y ago
I don't believe the UK gov have a TLS CA in any standard browser deployments do they? I'm not even sure we have a CA HQd here for them to compel into giving them certs for mitm?
- arethuza 13y ago
  Out of curiosity I had a quick scan through the "Trusted Root Certification Authorities" on this Windows 7 box and it's quite a surprising list - I have no idea who a lot of these organizations are... Also, one thing I'm pretty confident about, is that if GCHQ is behind any of these certs they wouldn't go labeling it as "UK Government - GCHQ". So presumably I'm just trusting Microsoft that when these certs get pushed out as part of Windows they are who they say they are...
  - Maxious 13y ago
    CA's can issue or lose intermediate certificates that they shouldn't. These have been detected at least 3 times when these technically valid but never before seen certificate chains are used for google.com/yahoo.com/microsoft.com etc. http://googleonlinesecurity.blogspot.com.au/2013/01/enhancing-digital-certificate-security.html http://googleonlinesecurity.blogspot.com.au/2013/01/enhancin... https://blog.torproject.org/blog/detecting-certificate-authority-compromises-and-web-browser-collusion https://blog.torproject.org/blog/detecting-certificate-autho... http://www.chromium.org/Home/chromium-security/root-ca-policy http://www.chromium.org/Home/chromium-security/root-ca-polic...
- willvarfar 13y ago
  http://www.mozilla.org/en-US/about/governance/policies/security-group/certs/included/ http://www.mozilla.org/en-US/about/governance/policies/secur... lists those that firefox currently trusts. How many of them are not amenable to some government somewhere? 0. And how many would GCHQ have to compromise to get deniable MITM? 1.
__alexs 13y ago
I don't believe the UK gov have a TLS CA in any standard browser deployments do they? I'm not even sure we have a CA HQd here for them to compel into giving them certs for mitm?
deleted 13y ago
[deleted]
corresation 13y ago
Governments don't outright operate CAs, but given the long list of trusted authorities and intermediates in every modern browser, and given the various successes of these agencies, it seems a probable certainty that if they need to generate a trusted cert for given targets, they can. In effect I am agreeing. The Apple SSL bug seemed overblown (from a government perspective) for that reason, and unlikely to be a government effort. Exploiting a CA seems significantly easier than embedding bugs in specific platforms. I suppose they might do both, but I doubt their abilities were reduced after it was patched.

__alexs 13y ago

I don't believe the UK gov have a TLS CA in any standard browser deployments do they? I'm not even sure we have a CA HQd here for them to compel into giving them certs for mitm?

arethuza 13y ago
Out of curiosity I had a quick scan through the "Trusted Root Certification Authorities" on this Windows 7 box and it's quite a surprising list - I have no idea who a lot of these organizations are... Also, one thing I'm pretty confident about, is that if GCHQ is behind any of these certs they wouldn't go labeling it as "UK Government - GCHQ". So presumably I'm just trusting Microsoft that when these certs get pushed out as part of Windows they are who they say they are...
- Maxious 13y ago
  CA's can issue or lose intermediate certificates that they shouldn't. These have been detected at least 3 times when these technically valid but never before seen certificate chains are used for google.com/yahoo.com/microsoft.com etc. http://googleonlinesecurity.blogspot.com.au/2013/01/enhancing-digital-certificate-security.html http://googleonlinesecurity.blogspot.com.au/2013/01/enhancin... https://blog.torproject.org/blog/detecting-certificate-authority-compromises-and-web-browser-collusion https://blog.torproject.org/blog/detecting-certificate-autho... http://www.chromium.org/Home/chromium-security/root-ca-policy http://www.chromium.org/Home/chromium-security/root-ca-polic...
willvarfar 13y ago
http://www.mozilla.org/en-US/about/governance/policies/security-group/certs/included/ http://www.mozilla.org/en-US/about/governance/policies/secur... lists those that firefox currently trusts. How many of them are not amenable to some government somewhere? 0. And how many would GCHQ have to compromise to get deniable MITM? 1.

__alexs 13y ago

I don't believe the UK gov have a TLS CA in any standard browser deployments do they? I'm not even sure we have a CA HQd here for them to compel into giving them certs for mitm?

deleted 13y ago

[deleted]

corresation 13y ago

Governments don't outright operate CAs, but given the long list of trusted authorities and intermediates in every modern browser, and given the various successes of these agencies, it seems a probable certainty that if they need to generate a trusted cert for given targets, they can. In effect I am agreeing. The Apple SSL bug seemed overblown (from a government perspective) for that reason, and unlikely to be a government effort. Exploiting a CA seems significantly easier than embedding bugs in specific platforms. I suppose they might do both, but I doubt their abilities were reduced after it was patched.