4 ms·
I don't believe the UK gov have a TLS CA in any standard browser deployments do they? I'm not even sure we have a CA HQd here for them to compel into giving the
by __alexs 13y ago
I don't believe the UK gov have a TLS CA in any standard browser deployments do they? I'm not even sure we have a CA HQd here for them to compel into giving them certs for mitm?
- arethuza 13y agoOut of curiosity I had a quick scan through the "Trusted Root Certification Authorities" on this Windows 7 box and it's quite a surprising list - I have no idea who a lot of these organizations are... Also, one thing I'm pretty confident about, is that if GCHQ is behind any of these certs they wouldn't go labeling it as "UK Government - GCHQ". So presumably I'm just trusting Microsoft that when these certs get pushed out as part of Windows they are who they say they are...
- Maxious 13y agoCA's can issue or lose intermediate certificates that they shouldn't. These have been detected at least 3 times when these technically valid but never before seen certificate chains are used for google.com/yahoo.com/microsoft.com etc. http://googleonlinesecurity.blogspot.com.au/2013/01/enhancing-digital-certificate-security.html http://googleonlinesecurity.blogspot.com.au/2013/01/enhancin... https://blog.torproject.org/blog/detecting-certificate-authority-compromises-and-web-browser-collusion https://blog.torproject.org/blog/detecting-certificate-autho... http://www.chromium.org/Home/chromium-security/root-ca-policy http://www.chromium.org/Home/chromium-security/root-ca-polic...
- willvarfar 13y agohttp://www.mozilla.org/en-US/about/governance/policies/security-group/certs/included/ http://www.mozilla.org/en-US/about/governance/policies/secur... lists those that firefox currently trusts. How many of them are not amenable to some government somewhere? 0. And how many would GCHQ have to compromise to get deniable MITM? 1.