5 ms·

With great power comes great responsibility. It's not because there were no misuse of the certificates this time that it didn't happen or would have not happen.

by neumino 12y ago

With great power comes great responsibility. It's not because there were no misuse of the certificates this time that it didn't happen or would have not happen. I personally have removed their certificates from my system. This is the responsible move to do if you care about your security or don't want your computers to be used as part of the DDoS like we've seen against GitHub.

bigiain 12y ago
Does anyone know if there's a way yet to do this on unjailbroken iOS devices? This suggests no: http://apple.stackexchange.com/questions/23720/how-do-i-un-trust-or-remove-blacklisted-root-cas-from-mobile-safari-on-my-iphone http://apple.stackexchange.com/questions/23720/how-do-i-un-t...
- ikeboy 12y ago
  It looks like not, but here's a list if it helps http://karl.kornel.us/2014/09/an-analysis-of-the-cas-trusted-by-ios-8-0/ http://karl.kornel.us/2014/09/an-analysis-of-the-cas-trusted...
logotype 12y ago
Here's how to remove CNNIC from OSX (check two first commands only) https://github.com/logotype/useful-unix-stuff/blob/master/useful-unix-stuff.sh https://github.com/logotype/useful-unix-stuff/blob/master/us... Hope someone finds this useful!
- ishtu 12y ago
  It tells me security: SecTrustSettingsRemoveTrustSettings (user): No Trust Settings were found. security: SecTrustSettingsRemoveTrustSettings (admin): No Trust Settings were found.
mirashii 12y ago
> don't want your computers to be used as part of the DDoS like we've seen against GitHub. Let's not conflate two mostly unrelated things here. Removing this root certificate does nothing to stop this attack against Github.
- neumino 12y ago
  It prevents your computer from loading undesired piece of JavaScript in case of a MITM attack. It doesn't prevent things if the server itself serve you malware, but that's another story.
  - mirashii 12y ago
    > It prevents your computer from loading undesired piece of JavaScript in case of a MITM attack. Only if the site you were visiting was over HTTPS, which it was not in the Github attack. Saying that you should remove this certificate if you don't want to participate in the Github attack or similar attacks is simply not true.
vilda 12y ago
On Debian and Ubuntu systems run this through sudo or as root: dpkg-reconfigure ca-certificates And select/deselect CAs you trust.
- dredmorbius 12y ago
  Or edit /etc/ca-certificates.conf directly and run update-ca-certificates afterwards (as the file advises). I'm normally a fan of dpkg-reconfigure, but in this case, paging through 25 screens of 6 certs at a time, without search, is a far worse case than firing up your preferred browser, finding the root you want to revoke, and planting a bang '!' in front of it. Otherwise, the processes vilda and I describe are identical.

by neumino 12y ago

bigiain 12y ago

Does anyone know if there's a way yet to do this on unjailbroken iOS devices? This suggests no: http://apple.stackexchange.com/questions/23720/how-do-i-un-trust-or-remove-blacklisted-root-cas-from-mobile-safari-on-my-iphone http://apple.stackexchange.com/questions/23720/how-do-i-un-t...

ikeboy 12y ago
It looks like not, but here's a list if it helps http://karl.kornel.us/2014/09/an-analysis-of-the-cas-trusted-by-ios-8-0/ http://karl.kornel.us/2014/09/an-analysis-of-the-cas-trusted...

logotype 12y ago

Here's how to remove CNNIC from OSX (check two first commands only) https://github.com/logotype/useful-unix-stuff/blob/master/useful-unix-stuff.sh https://github.com/logotype/useful-unix-stuff/blob/master/us... Hope someone finds this useful!

ishtu 12y ago
It tells me security: SecTrustSettingsRemoveTrustSettings (user): No Trust Settings were found. security: SecTrustSettingsRemoveTrustSettings (admin): No Trust Settings were found.

mirashii 12y ago

> don't want your computers to be used as part of the DDoS like we've seen against GitHub. Let's not conflate two mostly unrelated things here. Removing this root certificate does nothing to stop this attack against Github.

neumino 12y ago
It prevents your computer from loading undesired piece of JavaScript in case of a MITM attack. It doesn't prevent things if the server itself serve you malware, but that's another story.
- mirashii 12y ago
  > It prevents your computer from loading undesired piece of JavaScript in case of a MITM attack. Only if the site you were visiting was over HTTPS, which it was not in the Github attack. Saying that you should remove this certificate if you don't want to participate in the Github attack or similar attacks is simply not true.

vilda 12y ago

On Debian and Ubuntu systems run this through sudo or as root: dpkg-reconfigure ca-certificates And select/deselect CAs you trust.

dredmorbius 12y ago
Or edit /etc/ca-certificates.conf directly and run update-ca-certificates afterwards (as the file advises). I'm normally a fan of dpkg-reconfigure, but in this case, paging through 25 screens of 6 certs at a time, without search, is a far worse case than firing up your preferred browser, finding the root you want to revoke, and planting a bang '!' in front of it. Otherwise, the processes vilda and I describe are identical.