5 ms·

If they got caught it'd get removed from Firefox and Chrome. I am more surprised that they don't have common Chinese software install a set of MitM CAs.

by ryan-c 12y ago

dmix 12y ago
> I am more surprised that they don't have common Chinese software install a set of MitM CAs. It said in the article: the most popular Chinese browser Qihoop 360 browser doesn't even giving a warning for the bad SSL cert. "Qihoo’s popular Chinese 360 secure browser is anything but and will load the MITMed page directly." https://en.wikipedia.org/wiki/Qihoo https://en.wikipedia.org/wiki/Qihoo
- ryan-c 12y ago
  See my other comment. * The popularity of that browser is way over reported - they tend to report "installed" statistics rather than "used". * If you read the article you'll see self signed certificates were used for the MitM. From my own research, 360 secure browser just doesn't validate certificates in many circumstances. No CA required.
  - ttflee 12y ago
    According to my observation Qihoo Browser was more frequently used by a tech noob than tech savvy. And this alone poses great risk of the general public regardless to the underlying ethnics and interests.
danielweber 12y ago
How do you know that Firefox and Chrome have not been altered?
- ikawe 12y ago
  The app code signing process provides some assurance that the app has not been altered. https://developer.apple.com/library/mac/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html https://developer.apple.com/library/mac/documentation/Securi... edit: but only in so much as you trust Apple, as they provide and verify the keys. But... assuming you're using an iphone, this isn't really a new threat vector.
- ryan-c 12y ago
  Any software installed on the system can add root CAs to both of them.
  - rictic 12y ago
    This may no longer be true for Chrome at least. They recently added protection against unauthorized configuration changes by third party programs. I'm having trouble determining whether that protection extends to root CAs though.
    - ryan-c 12y ago
      Chrome, last I checked, mostly relies on the OS list of trusted CAs in OS X and Windows, and brings its own on Linux which uses NSS.

If they got caught it'd get removed from Firefox and Chrome. I am more surprised that they don't have common Chinese software install a set of MitM CAs.

by ryan-c 12y ago

If they got caught it'd get removed from Firefox and Chrome. I am more surprised that they don't have common Chinese software install a set of MitM CAs.

dmix 12y ago

> I am more surprised that they don't have common Chinese software install a set of MitM CAs. It said in the article: the most popular Chinese browser Qihoop 360 browser doesn't even giving a warning for the bad SSL cert. "Qihoo’s popular Chinese 360 secure browser is anything but and will load the MITMed page directly." https://en.wikipedia.org/wiki/Qihoo https://en.wikipedia.org/wiki/Qihoo

ryan-c 12y ago
See my other comment. * The popularity of that browser is way over reported - they tend to report "installed" statistics rather than "used". * If you read the article you'll see self signed certificates were used for the MitM. From my own research, 360 secure browser just doesn't validate certificates in many circumstances. No CA required.
- ttflee 12y ago
  According to my observation Qihoo Browser was more frequently used by a tech noob than tech savvy. And this alone poses great risk of the general public regardless to the underlying ethnics and interests.

danielweber 12y ago

How do you know that Firefox and Chrome have not been altered?

ikawe 12y ago
The app code signing process provides some assurance that the app has not been altered. https://developer.apple.com/library/mac/documentation/Security/Conceptual/CodeSigningGuide/Introduction/Introduction.html https://developer.apple.com/library/mac/documentation/Securi... edit: but only in so much as you trust Apple, as they provide and verify the keys. But... assuming you're using an iphone, this isn't really a new threat vector.
ryan-c 12y ago
Any software installed on the system can add root CAs to both of them.
- rictic 12y ago
  This may no longer be true for Chrome at least. They recently added protection against unauthorized configuration changes by third party programs. I'm having trouble determining whether that protection extends to root CAs though.
  - ryan-c 12y ago
    Chrome, last I checked, mostly relies on the OS list of trusted CAs in OS X and Windows, and brings its own on Linux which uses NSS.