5 ms·
It's just an organizational decision. CNNIC is super trustworthy to a lot of people. It's so many people, in fact, that they can't possibly verify all of the si
by anfedorov 12y ago
It's just an organizational decision. CNNIC is super trustworthy to a lot of people. It's so many people, in fact, that they can't possibly verify all of the sites these people want to visit. So instead of burdening CNNIC with verifying the identity of every single site that wants a cert that their users will trust, CNNIC will just verify some other CAs as being trustworthy enough to do the job.
Personally, I think I should trust the hardware or OS manufacturer to pick exactly who is trustworthy enough to certify websites, since I'm trusting them that my computer is doing what it looks like it's doing anyway.
- click170 12y agoI trust my OS to suggest sane defaults, but if I can't override them that's a bug IMO.
- andreyf 12y agoGood point. You're still trusting them to implement the rest of the system you are using securely, though.
- est 12y ago> CNNIC is super trustworthy to a lot of people No, CNNIC is not even trustworthy among Chinese Internet users. CNNIC invented tons of rootkit adware and spyware. It has a very bad reputation. Google for 3721 中文网址 if you are interested Although it claims to be a neutral non-profit organization, it does have multiple for-profit business lines. In the past CNNIC belongs to China Academy of Science, but now it's just a puppet under ruling Party's control[1][2]. [1]: http://en.wikipedia.org/wiki/Central_Leading_Group_for_Internet_Security_and_Informatization http://en.wikipedia.org/wiki/Central_Leading_Group_for_Inter... [2]: News in Chinese http://tech.gmw.cn/2014-12/27/content_14311910.htm http://tech.gmw.cn/2014-12/27/content_14311910.htm
- blacktulip 12y ago> No, CNNIC is not even trustworthy among Chinese Internet users. CNNIC is not trustworthy especially among Chinese Internet users.
- crazychrome 12y agoabsolutely! In general I trust pure commercial organisations more than govt. and non-profit orgs.
- andreyf 12y ago> CNNIC is not even trustworthy among Chinese Internet users. Oh? Then why did Firefox, Google, Microsoft, Apple, etc. trust their root certificate? I know hating on China is all the rage, but something isn't making sense here... > Google for 3721 中文网址 if you are interested Just did. Got nothing. Are you referring to [1]? I'm not seeing what that has to do with CNNIC. 1. https://en.wikipedia.org/wiki/Yahoo!_Assistant https://en.wikipedia.org/wiki/Yahoo!_Assistant
- est 12y ago> Oh? Then why did Firefox, Google, Microsoft, Apple, etc. trust their root certificate? Mozilla no longer trust CNNIC. https://blog.mozilla.org/security/2015/04/02/distrusting-new-cnnic-certificates/ https://blog.mozilla.org/security/2015/04/02/distrusting-new...
- andreyf 12y agoYes, hence my using the past tense. I do not see how "CNNIC is [not trustworthy]" is compatible with "Firefox, Google, Apple, and Microsoft trusted their certificates until MCS Holding screwed up some corporate network's https-interception implementation". In particular, was there any evidence of any mis-deeds by the CNNIC before what MCS Holding did? Anything at all aside from "they are a Chinese and that is bad" FUD? Have they ever issued a certificate used to MITM the communications of political dissidents, for example?
- dragonwriter 12y agoTFA is about the fact that Google no longer does trust CNNIC. And Mozilla no longer does, for the same reason.