4 ms·

I think the two scariest discoveries with Superfish are that Microsoft allows an OEM to ship a retail Windows computer with additional root certificates, and th

I think the two scariest discoveries with Superfish are that Microsoft allows an OEM to ship a retail Windows computer with additional root certificates, and that Chrome is trusting the root certificates stored by Windows -- Firefox does not. My proposed actions: (1) Microsoft should immediately update their OEM agreements to ban all manipulation of root certificates for computers sold at retail. Further, the root certificate store should be cryptographically signed by Microsoft and this signature validated during Windows OOBE. (2) Google should follow Mozilla's lead and have Chrome securely manage its own root certificate store. (It could be disabled for legitimate corporate deployments, but never with the regular end-user Chrome installer.)

toast0 12y ago
Chrome has chosen to use the system network (proxy) settings, the system SSL stack, etc. It actually makes sense for them to use the state CA store. Firefox's legacy includes platforms where there was no system any of that. As use shouldn't need to set proxy settings or corporate CAs for every application they run. Otoh, it is unfortunate that chrome has different SSL behavior on every platform.
- jesseendahl 12y ago
  When it comes to SSL/TLS, "on all platforms, [they] use NSS's libssl to handle the SSL connection logic... [and] ... platform specific APIs for certificate verification."
userbinator 12y ago
Further, the root certificate store should be cryptographically signed by Microsoft and this signature validated during Windows OOBE. This is just one small step down the path of not allowing any modification to the root certificate store, and that is an even scarier situation, since users will have absolutely no control over who they decide to trust.
- sjwright 12y ago
  I would agree with you if most users understood the concept of trust as it relates to the root certificate store. Very few do, likely less than 1%. Therefore I believe it must be Microsoft's responsibility to be the singular default trusted entity for the root certificate store shipped to retail consumers as part of Microsoft Windows. Your slippery slope argument fails because your "small step" would be immediately rejected by the vast majority of the Fortune 500, for starters. It just couldn't happen. It would be unworkable.
MichaelGG 12y ago
Devil's advocate: But then if an OEM wants to install themselves as a root, they cannot. That's anti competitive. Why should MS be especially trusted over the OEM? Slowly and way too late, MS has been learning that their "partners" mostly suck and hold a lot of responsibility for MS being so far behind today. MS shipped tablet PC how long before Apple? But they figured "yeah HP and Dell will handle our customer experience well, sure". Also, how is Chrome gonna determine a legitimate deployment? Cause then the dev just needs to convince Chrome it's in a corp environment. Or... Just ship a patched version of Chrome/FF/whatever that doesn't do cert validation.
- chris_j 12y ago
  Devil's advocate on your devil's advocate: what legitimate reason could an OEM have for installing a root certificate?
  - MichaelGG 12y ago
    Same as MS? Maybe they feel they have a better idea on who to trust and thus add and remove certificates as necessary. Maybe they want to sign their own hardware drivers (though, I think those don't use the system CA store). Perhaps they want to offer signatures to customers or software vendors and feel current MS provided CAs are lacking. More mundane, perhaps there's a cheaper CA that's accepted by some trusts, but not MS. Why should MS be trusted more than $OEM? OK, fairly weak arguments, but the freedom of doing so is important. Just as it is important that users be able to verify and undo and choose their root of trust. The concept of a global root of trust breaks down pretty fast. And the OEM can already compromise anything anyways.
    - sjwright 12y ago
      > Same as MS? Maybe they feel they have a better idea on who to trust How would the consumer know who they're trusting?
- sjwright 12y ago
  > how is Chrome gonna determine a legitimate deployment? Terms and conditions. The corporate version can not be pre-loaded on computers sold at retail unless explicitly ordered by the customer. > Just ship a patched version Again, T&Cs. I believe it's already a license breach to distribute a modified or patched build of Firefox unless the branding is stripped out -- this is why Debian shipped Iceweasel rather than Firefox. The same probably already applies with Chrome/Chromium.
gumby 12y ago
> Microsoft should immediately update their OEM agreements to ban all manipulation of root certificates for computers sold at retail. You realize that Microsoft is forbidden from doing this by their consent decree, and that their argument at the time to the DOJ was that it would restrict them from stopping bad actors. I say this not to defend Microsoft, just to state the facts. They were bullies and frankly got off with a slap on the wrist. But it's an important lesson in the NN pseudo-debate. I am not a fan of NN because I do agree, no matter how constructed, it will retard innovation and have negative loopholes like this snapfish one on the PC. But the carriers are abusive and have been proven plenty of times to be untrustworthy so I don't know any better option. Here's a description of the relevant part of the consent decree from a 2003 compliance memo: Section III.H of the Consent Decree requires Microsoft to allow end users and OEMs to enable or remove access to all middleware products including web browsers, e-mail clients, and media players through a readily accessible, centralized mechanism. This mechanism must also allow end users and OEMs to specify a non-Microsoft middleware product as the default middleware product to be launched in place of the corresponding Microsoft middleware product. In order to comply with Section III.H, Microsoft created the "Set Program Access & Defaults" ("SPA&D") utility and included it in Windows XP Service Pack 1 and Windows 2000 Service Pack 3.

toast0 12y ago

Chrome has chosen to use the system network (proxy) settings, the system SSL stack, etc. It actually makes sense for them to use the state CA store. Firefox's legacy includes platforms where there was no system any of that. As use shouldn't need to set proxy settings or corporate CAs for every application they run. Otoh, it is unfortunate that chrome has different SSL behavior on every platform.

jesseendahl 12y ago
When it comes to SSL/TLS, "on all platforms, [they] use NSS's libssl to handle the SSL connection logic... [and] ... platform specific APIs for certificate verification."

userbinator 12y ago

Further, the root certificate store should be cryptographically signed by Microsoft and this signature validated during Windows OOBE. This is just one small step down the path of not allowing any modification to the root certificate store, and that is an even scarier situation, since users will have absolutely no control over who they decide to trust.

sjwright 12y ago
I would agree with you if most users understood the concept of trust as it relates to the root certificate store. Very few do, likely less than 1%. Therefore I believe it must be Microsoft's responsibility to be the singular default trusted entity for the root certificate store shipped to retail consumers as part of Microsoft Windows. Your slippery slope argument fails because your "small step" would be immediately rejected by the vast majority of the Fortune 500, for starters. It just couldn't happen. It would be unworkable.

MichaelGG 12y ago

Devil's advocate: But then if an OEM wants to install themselves as a root, they cannot. That's anti competitive. Why should MS be especially trusted over the OEM? Slowly and way too late, MS has been learning that their "partners" mostly suck and hold a lot of responsibility for MS being so far behind today. MS shipped tablet PC how long before Apple? But they figured "yeah HP and Dell will handle our customer experience well, sure". Also, how is Chrome gonna determine a legitimate deployment? Cause then the dev just needs to convince Chrome it's in a corp environment. Or... Just ship a patched version of Chrome/FF/whatever that doesn't do cert validation.

chris_j 12y ago
Devil's advocate on your devil's advocate: what legitimate reason could an OEM have for installing a root certificate?
- MichaelGG 12y ago
  Same as MS? Maybe they feel they have a better idea on who to trust and thus add and remove certificates as necessary. Maybe they want to sign their own hardware drivers (though, I think those don't use the system CA store). Perhaps they want to offer signatures to customers or software vendors and feel current MS provided CAs are lacking. More mundane, perhaps there's a cheaper CA that's accepted by some trusts, but not MS. Why should MS be trusted more than $OEM? OK, fairly weak arguments, but the freedom of doing so is important. Just as it is important that users be able to verify and undo and choose their root of trust. The concept of a global root of trust breaks down pretty fast. And the OEM can already compromise anything anyways.
  - sjwright 12y ago
    > Same as MS? Maybe they feel they have a better idea on who to trust How would the consumer know who they're trusting?
sjwright 12y ago
> how is Chrome gonna determine a legitimate deployment? Terms and conditions. The corporate version can not be pre-loaded on computers sold at retail unless explicitly ordered by the customer. > Just ship a patched version Again, T&Cs. I believe it's already a license breach to distribute a modified or patched build of Firefox unless the branding is stripped out -- this is why Debian shipped Iceweasel rather than Firefox. The same probably already applies with Chrome/Chromium.

gumby 12y ago

> Microsoft should immediately update their OEM agreements to ban all manipulation of root certificates for computers sold at retail. You realize that Microsoft is forbidden from doing this by their consent decree, and that their argument at the time to the DOJ was that it would restrict them from stopping bad actors. I say this not to defend Microsoft, just to state the facts. They were bullies and frankly got off with a slap on the wrist. But it's an important lesson in the NN pseudo-debate. I am not a fan of NN because I do agree, no matter how constructed, it will retard innovation and have negative loopholes like this snapfish one on the PC. But the carriers are abusive and have been proven plenty of times to be untrustworthy so I don't know any better option. Here's a description of the relevant part of the consent decree from a 2003 compliance memo: Section III.H of the Consent Decree requires Microsoft to allow end users and OEMs to enable or remove access to all middleware products including web browsers, e-mail clients, and media players through a readily accessible, centralized mechanism. This mechanism must also allow end users and OEMs to specify a non-Microsoft middleware product as the default middleware product to be launched in place of the corresponding Microsoft middleware product. In order to comply with Section III.H, Microsoft created the "Set Program Access & Defaults" ("SPA&D") utility and included it in Windows XP Service Pack 1 and Windows 2000 Service Pack 3.