Mozilla Debates Whether To Trust Chinese CA

At his Freedom to Tinker blog, Ed Felten has a thoughtful, accessible piece on the debate at Mozilla about whether Firefox, by default, should trust a Chinese certificate authority (as it has since October). Felten explains in clear language why this is significant, and therefore controversial. An excerpt: "To see why this is worrisome, let's suppose, just for the sake of argument, that CNNIC were a puppet of the Chinese government. Then CNNIC's status as a trusted CA would give it the technical power to let the Chinese government spy on its citizens' 'secure' web connections. If a Chinese citizen tried to make a secure connection to Gmail, their connection could be directed to an impostor Gmail site run by the Chinese government, and CNNIC could give the impostor a cert saying that the government impostor was the real Gmail site."

Comments

Re:Why not change of certifcation notification?

[jhantin]

Have a look at Perspectives: an approach to detecting MITM attacks by comparing the keys visible from other vantage points on the net.

Re:Well in that case

[theshowmecanuck]

And I forgot to add that I disagree with the OP's sig that patriotism is bigotry. While I am not a big fan of deGaulle (let's just say I would have preferred we left him in Dunkirk when the Germans arrived), proving the "exception to the rule" rule, he said one smart thing:

"Patriotism is when love of your own people comes first; nationalism, when hate for people other than your own comes first." -deGaulle

Nationalism is bigotry. Nationalism leads to ethnic cleansing, even in the form of language laws. The statement is true even though it is completely at odds with his bullshit behaviour in Quebec in 1967 where he supported nationalism (and stuck his nose in Canada's affairs... and pissed off enough people that he had to fly home early leaving the ship he came in to sail home without him... and earning him the status of "rectum non grata" in Canada).