4 ms·

They need to sign those certs with a CA. If they do this, they create a cryptographic proof that they're abusing their trust and are removed from the trust stor

by kpcyrd 12y ago

They need to sign those certs with a CA. If they do this, they create a cryptographic proof that they're abusing their trust and are removed from the trust store quickly.

leereeves 12y ago
In fact that happened about a week ago: http://arstechnica.com/security/2015/04/google-chrome-will-banish-chinese-certificate-authority-for-breach-of-trust/ http://arstechnica.com/security/2015/04/google-chrome-will-b... But if China chose to, they could simply require all Chinese websites to use government-issue certificates, forcing the world to choose between allowing Chinese MITM monitoring and losing access to China.
- acdha 12y ago
  > But if China chose to, they could simply require all Chinese websites to use government-issue certificates, forcing the world to choose between allowing Chinese MITM monitoring and losing access to China. The more likely outcome of that gambit would just be that the CA would be restricted to .cn domains, possibly with some sort of install-on-demand warning.
  - nitrogen 12y ago
    That would not necessarily prevent attacks like the GitHub attack, which used embedded analytics JS from Baidu, IIRC.
    - acdha 12y ago
      Actually, it would have stopped this particular variant because Baidu serves the script from baidu.com: http://www.netresec.com/?page=Blog&month=2015-03&post=China%27s-Man-on-the-Side-Attack-on-GitHub http://www.netresec.com/?page=Blog&month=2015-03&post=China%... That said, it would only matter if Baidu was doing something like serving the script only over HTTPS using HSTS which I imagine would incur a non-trivial backlash for them. I'd also be surprised if they couldn't relatively easily move on to another similarly insecure script requested by many people outside of China.
  - leereeves 12y ago
    > The more likely outcome of that gambit would just be that the CA would be restricted to .cn domains, possibly with some sort of install-on-demand warning. A reasonable compromise, but one which wouldn't prevent MITM snooping or alteration of communications with Chinese websites, like this attack. And to allow snooping of outgoing communications, the Chinese could also require that all browsers used in China trust the Chinese government CA without that restriction.
    - acdha 12y ago
      Agreed, although it technically would have helped against attacks like the ones we just saw where most of the parties involved – including Baidu – are using .com domains. No question, of course, that this would only result in heavy pressure on everyone doing business in China to use .cn domains.

by kpcyrd 12y ago

They need to sign those certs with a CA. If they do this, they create a cryptographic proof that they're abusing their trust and are removed from the trust store quickly.

leereeves 12y ago

In fact that happened about a week ago: http://arstechnica.com/security/2015/04/google-chrome-will-banish-chinese-certificate-authority-for-breach-of-trust/ http://arstechnica.com/security/2015/04/google-chrome-will-b... But if China chose to, they could simply require all Chinese websites to use government-issue certificates, forcing the world to choose between allowing Chinese MITM monitoring and losing access to China.

acdha 12y ago
> But if China chose to, they could simply require all Chinese websites to use government-issue certificates, forcing the world to choose between allowing Chinese MITM monitoring and losing access to China. The more likely outcome of that gambit would just be that the CA would be restricted to .cn domains, possibly with some sort of install-on-demand warning.
- nitrogen 12y ago
  That would not necessarily prevent attacks like the GitHub attack, which used embedded analytics JS from Baidu, IIRC.
  - acdha 12y ago
    Actually, it would have stopped this particular variant because Baidu serves the script from baidu.com: http://www.netresec.com/?page=Blog&month=2015-03&post=China%27s-Man-on-the-Side-Attack-on-GitHub http://www.netresec.com/?page=Blog&month=2015-03&post=China%... That said, it would only matter if Baidu was doing something like serving the script only over HTTPS using HSTS which I imagine would incur a non-trivial backlash for them. I'd also be surprised if they couldn't relatively easily move on to another similarly insecure script requested by many people outside of China.
- leereeves 12y ago
  > The more likely outcome of that gambit would just be that the CA would be restricted to .cn domains, possibly with some sort of install-on-demand warning. A reasonable compromise, but one which wouldn't prevent MITM snooping or alteration of communications with Chinese websites, like this attack. And to allow snooping of outgoing communications, the Chinese could also require that all browsers used in China trust the Chinese government CA without that restriction.
  - acdha 12y ago
    Agreed, although it technically would have helped against attacks like the ones we just saw where most of the parties involved – including Baidu – are using .com domains. No question, of course, that this would only result in heavy pressure on everyone doing business in China to use .cn domains.