10 ms·
CNNIC's response to Google
- higherpurpose 12y agoChina's response is kind of funny. But if they have no bad intentions, they can just implement CT and not have to worry about it. Of course, if you read between the lines in the last paragraph, you realize that they do have bad intentions. That last line is quite 1984-ish.
- zenincognito 12y agoThis will head towards a tit for tat thing. Much like the cold war except this time its cyber in nature.
- justicezyx 12y ago...Those state-owned businesses are always funny.
- nickodell 12y ago>2. For the users that CNNIC has already issued the certificates to, we guarantee that your lawful rights and interests will not be affected. ... Does that mean anything?
- notatoad 12y agoIt probably means that the CNNIC certs will still be valid in China, as Google doesn't directly distribute any software there directly and the Chinese government can tell the Chinese software vendors to trust its cert regardless of what google thinks.
- deleted 12y ago[deleted]
- kijin 12y agoTheir lawful rights and interests will not be affected because, in the opinion of the Chinese government, anyone who uses Chrome in China is doing so unlawfully! (Last time I checked, the GFW blocked Chrome downloads.)
- netheril96 12y agoExcept there are plenty of Chinese websites (including Baidu) that offer the latest Chrome downloads. In fact, the majority of my friends (I am a Chinese) all use Chrome and they are not software developers. Many Chinese websites are tested against Google Chrome (in addition to IE and Firefox). Put simply, people in China act as if Google Chrome were not blocked at all.
- AYBABTME 12y agoAnd the binaries aren't modified?
- netheril96 12y agoWell, the binaries from reputable sites are not modified. I just downloaded a Google Chrome for OS X from Baidu and successfully verified it with digital signature. Of course, there are also shoddy sites, but that is equally true for American websites.
- AYBABTME 12y agoThe difference is that outside of China, you can get your binary straight from Google =P
- mspecter 12y ago>"...meanwhile CNNIC sincerely urge that Google would take users’ rights and interests into full consideration" And that, ladies and gentlemen, is exactly what they're doing.
- dsl 12y agoCNNICs users' rights and interests are not being taken into consideration. Make no mistake, they are looking to protect their customers, not you and I.
- jsprogrammer 12y agoRight, their users are the ones who purchase certs, not browsers.
- bigiain 12y agoI think the argument here goes "CNNIC is a government department in China. Government departments 'customers' are rarely the people from whom they take money or provide services - their actual 'customers' are other more-powerful government departments, or the current political powerholders."
- deleted 12y ago[deleted]
- liareye 12y agoTOP KEK
- kijin 12y agoWho are the people and companies that use CNNIC-issued certificates? CNNIC is a relatively recent addition to most browsers' lists of trusted CAs. Moreover, given the popularity of pirated & never-updated Windows XP in China, it would have been foolish for any serious Chinese business to use an SSL certificate from any vendor other than globally recognized ones like Comodo and Verisign.
- yuhong 12y agoI think WinXP has come with separate auto root update since RTM.
- tifan 12y agoDid you know most Chinese browser vendors will explicitly disable SSL certificate validity check?
- ncza 12y agoProof please
- deleted 12y ago[deleted]
- pki 12y ago360 browser accepts all certs, incl self signed. no warnings. also lol: 'high usage numbers are in large part due to the software being very difficult to uninstall. Furthermore, whenever a user attempts to install another browser, a warning pop-up claims that the new browser is unsafe and should not be run'
- ytch 12y agoFYI: https://cabforum.org/pipermail/public/2014-October/004278.html https://cabforum.org/pipermail/public/2014-October/004278.ht...
- neumino 12y agoWith great power comes great responsibility. It's not because there were no misuse of the certificates this time that it didn't happen or would have not happen. I personally have removed their certificates from my system. This is the responsible move to do if you care about your security or don't want your computers to be used as part of the DDoS like we've seen against GitHub.
- bigiain 12y agoDoes anyone know if there's a way yet to do this on unjailbroken iOS devices? This suggests no: http://apple.stackexchange.com/questions/23720/how-do-i-un-trust-or-remove-blacklisted-root-cas-from-mobile-safari-on-my-iphone http://apple.stackexchange.com/questions/23720/how-do-i-un-t...
- ikeboy 12y agoIt looks like not, but here's a list if it helps http://karl.kornel.us/2014/09/an-analysis-of-the-cas-trusted-by-ios-8-0/ http://karl.kornel.us/2014/09/an-analysis-of-the-cas-trusted...
- logotype 12y agoHere's how to remove CNNIC from OSX (check two first commands only) https://github.com/logotype/useful-unix-stuff/blob/master/useful-unix-stuff.sh https://github.com/logotype/useful-unix-stuff/blob/master/us... Hope someone finds this useful!
- ishtu 12y agoIt tells me security: SecTrustSettingsRemoveTrustSettings (user): No Trust Settings were found. security: SecTrustSettingsRemoveTrustSettings (admin): No Trust Settings were found.
- mirashii 12y ago> don't want your computers to be used as part of the DDoS like we've seen against GitHub. Let's not conflate two mostly unrelated things here. Removing this root certificate does nothing to stop this attack against Github.
- bigiain 12y agoThis is going to be interesting. My gut feel is that "rogue root CAs" need to have the fear of having their entire business shut down if they're caught out acting badly, and that CNNIC is the ideal opportunity for US-centric technology companies to take a stand without treading on too many profitable toes. If Microsoft and Apple joined in solidarity and announce they're taking CNNIC out of trusted roots (and, to a lesser extent, Mozilla), then it will be clear that the threats to CA's business/profit have some teeth. If they let this slide - it'll pretty much be open season for root trusted MITM certs to anyone with a few kilo or mega bucks to spare. It won't stop state-level actors from doing state-level bad-stuff(tm), but it might at least stop them from selling that ability to random big-corps as well. (And surely the opportunity to stand up to the Chinese Government with broad internet-community backing, especially in the face of the recent Github DDOS - the timing is about as perfect as it's ever likely to get, right?)
- jeswin 12y agoAccording to Tim Cook, China is becoming Apple's biggest Market. Microsoft software is similarly entrenched in China. There is no way those companies will do anything that jeopardizes that relationship. I salute Google. For all its forgivable flaws, it stands alone among large corporations in protecting free speech. And the nerve to pull out of the largest internet market on the planet. Kudos.
- beaner 12y agoThat's because everything is growing in China, including probably Android and Chromebooks. Google just had the guts to do the right thing.
- chkuendig 12y agoAndroid in China is AOSP or 3rd Party forks, NOT google android. There are no google services in china, so it's definitely an easier stand to take for Google than for its competitors doing business there.
- DigitalSea 12y agoNot really much of a response from CNNIC here. Notice how they spin this situation as Google taking away the rights of others? Google isn't the bad guy here, they're doing the reasonable thing and CNNIC have a lot of explaining to do...
- fit2rule 12y agoThose "others" = the Chinese government.
- nnrocks 12y agoVery true said. Gaining security is always in favor of public and organizations. Google is a authority, and many people take its statement seriously rather than others. And this approach may really take internet to safe side at some point. Nowadays ssl can be found at no price. Letsencrypt is going to provide at free of cost and vendors (like ssl.com and cheapsslshop.com ) selling such certs from nominal fee of $4 - $5 per year. Infact Government organization should shake hand with Google and motivate people to adopt such security asap.
- jtokoph 12y agoI find it interesting that visiting the https version of cnnic.cn in Chrome neither displays a lock icon nor a warning, but the certificate is displayed as valid: http://i.imgur.com/fTzxpBh.png http://i.imgur.com/fTzxpBh.png
- duskwuff 12y agoRelated to their use of SHA1 on the certificate: http://googleonlinesecurity.blogspot.com/2014/09/gradually-sunsetting-sha-1.html http://googleonlinesecurity.blogspot.com/2014/09/gradually-s...
- geofft 12y agoYup, this is it. The cnnic.cn end-entity certificate is SHA-1, which would do it. (I believe there's some sadness involved like Windows XP being excessively prevalent in China, or something... I vaguely recall a discussion of this on the cabforum public list, but I can't find it now.) If you click on the white page icon and go to the "Connection" tab, it'll say "This site is using outdated security settings," which generally (always, in current Chrome versions?) means SHA-1.
- dsl 12y agoGoogle is explicitly whitelisting the legitimate end-user certificates CNNIC has issued, and then revoking the root. Basically they had to hand over a list of all issued certificates, Google reviewed them, and CNNIC can't issue any new ones without asking Google to whitelist it.
- deleted 12y ago[deleted]
- deleted 12y ago[deleted]
- cskau 12y agoQuite the contrast to Google's response: We applaud CNNIC on their proactive steps, and welcome them to reapply once suitable technical and procedural controls are in place.
- ttflee 12y agoInterestingly, I cannot get round of CNNIC, as I am likely to operate some services for my employer on Windows Azure in China. http://www.cnnic.cn/jczyfw/fwqzs/fwqzsdtgg/201403/t20140312_46330.htm http://www.cnnic.cn/jczyfw/fwqzs/fwqzsdtgg/201403/t20140312_... Microsoft is using CNNIC certs for their Windows Azure services in China (, which of course is independent from Azure services in other regions, and is jointly operated with Chinese partners). If I marked CNNIC CA as untrustworthy, I would be expecting some alert in my Dashboard page, I guess.
- codert 12y agoCNNIC,you deserve it!
- codert 12y agoCNNIC,you deserve it!
- 101914 12y agoI know a user who runs her own root CA. She only has one "customer": herself. Using the OpenSSL binary the cost is free. She decides which hosts she wants to trust, obtains their certs and signs them. She believes she can trust her own CA more than any commercial, third party CA.
- peteretep 12y agoHow does she verify the certs she's getting?
- 101914 12y agoHow do the commercial CA's verify customers before issuing certs? Perhaps she does what they do. I imagine for example she knows her banker, her lawyer, etc. and can contact them by phone or meet with them in person. Maybe she also uses her friends to help her decide who to trust. She only has to verify a relatively small number of hosts compared to a commercial CA.
- sharth 12y agoWho could you possibly call at say Capital One to verify that a change in their certificate was intended instead of malicious?
- 101914 12y agoYour point is understood. For something like that, I have always thought they should be disseminating their cert via some other means besides an untrusted computer network (i.e., the internet). Or at least give customers another option. Perhaps making their cert available at branches (e.g., printed on business cards), mailing it to customers with an expository cover letter, or even publishing it in a newspaper or some publicly available printed source. Maybe these printed copies would be OCR-friendly, maybe not. I think two blobs of text can be compared to each other for differences without using a computer, and I can think of a few ways to make that easier. In any event, this does not seem an insurmoutable problem by any stretch of the imagination, at least for me, and in my mind the benefit outweighs the cost. Not sure about others, but I still get plenty of "official" notifications via postal mail. And with increasing frequency they relate to computer issues. This makes me wonder why certs "must" to be obtained and verified using (a) an untrusted computer network (the internet) and (b) why we need the aid of untrusted third parties often with obvious conflicts of interest to decide for us who else we can trust. Are these not the two things that that "SSL" authentication and encryption is designed to protect against?