Slashdot Mirror
Mozilla Debates Whether To Trust Chinese CA
At his Freedom to Tinker blog, Ed Felten has a thoughtful, accessible piece on the debate at Mozilla about whether Firefox, by default, should trust a Chinese certificate authority (as it has since October). Felten explains in clear language why this is significant, and therefore controversial. An excerpt: "To see why this is worrisome, let's suppose, just for the sake of argument, that CNNIC were a puppet of the Chinese government. Then CNNIC's status as a trusted CA would give it the technical power to let the Chinese government spy on its citizens' 'secure' web connections. If a Chinese citizen tried to make a secure connection to Gmail, their connection could be directed to an impostor Gmail site run by the Chinese government, and CNNIC could give the impostor a cert saying that the government impostor was the real Gmail site."
All you have to do is click your heels together three times, and repeat after me.
There's no place like Options / Advanced / Encryption / View Certificates / Authorities / (use mouse to select all) / DELETE. ...
There's no place like Options / Advanced / Encryption / View Certificates / Authorities / (use mouse to select all) / DELETE.
There's no place like Options / Advanced / Encryption / View Certificates / Authorities / (use mouse to select all) / DELETE.
"This post contains words, known to the State of California to cause thought. Wash brain thoroughly after reading."
OK, here it is:
World news for the last 30 years. Go ahead, google it. I'll wait while you catch up...
Oh they do, they just don't appear on your browser because China MITM'ed your http session and changed the website.