Slashdot Mirror
Mozilla Says It Erred On SSL Attack Disclosure
Trailrunner7 writes "Just days after news emerged of the attack on a registration authority in Europe tied to Comodo that caused the revocation of a number of fraudulent certificates from the major browsers, Mozilla officials have admitted they made a mistake by not disclosing the details of the incident to its users earlier. 'In hindsight, while it was made in good faith, this was the wrong decision. We should have informed web users more quickly about the threat and the potential mitigations as well as their side-effects.'"
D'OH!
when there is no other widely accepted way to verify a website's identity.
I don't see what the big deal is. Everybody knew about this vulnerability as soon as Microsoft told them about it anyhow.
Do daemons dream of electric sleep()?
That was an important detail, right? That it wasn't Comodo but some European registration authority, whatever that is supposed to be. Except Usertrust, the culprit, has a Comodo logo sitting right at the top of their web site, and "Comodo Home" and "About Comodo" links to go with it. Don't kid yourself, this was Comodo.
isn't that a surprise? doesn't mean it isn't still happening?
creators; stand by for another fake big flash
again, it's not us. believe whatever you're told? It's ALL out of the
chosen ones manual/schedule/agenda/anal 'math' depopulation schemes etc..,
which is resulting in many of our innocents being vaporized, which is
'better' than many of the others' current 'fate'. for god's sakes?
best bets; everyone (on our planet) voluntarily disarm yourselves. carry
on as it was originally intended for all of us. we instinctively know what
that is.
highly wagered longshots; eugenatics, weapons peddlers, kings/minions,
genetically altered mutants/hired goons. media decepticons, adrians,
religiously infactdead groanups, fake weather/induced seismicity
'scientists' etc...
hold on to your equatorial equilibrium.
in the end...in the middle... & from the beginning, babys rule..-- wee key (diaper) leaks group, perishability & play-dates pending world disarmament
Have your browser monitor for when certs are updated. And use public notaries to tell you whether others are seeing the same certs for the site.
Certificate Patrol
Perspectives
An example of who else is seeing the addons.mozilla.org cert you're seeing.
Comment removed based on user account deletion
On a positive note, you know what service I found that had a very good track record on this? Tarsnap.
It's a backup service I use. The client compresses and encrypts data on your end before sending it to the server, and the client isn't open-source, but it is source-viewable in the sense that you can download, inspect, and build the source yourself. All in all, great security - even from the provider.
Then one day a couple months ago I got an email from the provider warning that he had been alerted to a vulnerability. I was notified the same day as the provider, a fix was available that day, and there was an explanation of exactly what should be done to mitigate any breach that may have already been made. It was, in short, exactly what I would have wanted a service provider to do.
If this provider (which seems to be a one-man show) can pull this off, then I think we should expect it of the big boys.
Do you really imply that an OS made by a Corporation is more trustworthy than an .org like Mozilla? Are you perhaps living behind The Walled Garden?
Shouldn't this be the real title of this /. story.
Citrix was convinced to help defeat OSS not that long ago and that is why they made their clients choke on Firefox early in 2010.
Just before their big push to sell GO To My PC and how great it is to be able to easily do secure networking on Windows 7. All you have to do is turn on your TV and you see how MS.....NBC must be almost letting Citrix advertise for peanuts! How they can afford to advertise the heck out of a piece of software in prime time is a wonder to behold!
You do not have to worry about having dangerous FIrefox users using https to access your net with the Linux citrix ica client anymore. Of course if you just copy the certs to a different place then the citrix ica client will work with Firefox on either windows or linux.
I am coming to the conclusion that the networking giants like Citrix are starting to make it so you will have no choice in what operating system or browser you use to access Windows based servers...it is almost as if the coders at Citrix are really MS shills. Heck the new .deb ica client is a joke! It must have been cobbled together by an ex-microsoft employee!
So again I am being forced into buying a new copy of windows so my wife can do her work. The story has not change in 20 years. Use MS Office and Internet Explorer or you will not be able to do your work remotely or even read documents at home.
She used Firefox and Linux with Citrix safely for 4 years and now she is forced into using Internet Explorer because of changes to the location seek for certs in the Citrix clients. I am really getting sick and tired of being bullied by Microsoft and their "business partners".
They are getting away with all this shit because they are messing around again with compatibility on the net and no one is taking notice. It is obvious what is going on this time. Microsoft is in bed with Citrix and are trying to push Linux and Samba out the same way they are pressuring Motorola to drop Android, spreading fud on a mammoth scale and spending tons of cash to lobby Linux, Google/Android and many other competing networking software writers out of existence.
Being somewhat of a geek....and
To quote a famous rabbit..."you realise of course, this means war!"
Admitting it was a mistake rather than coming up with some bogus excuse gives them points in my book. Whether the decision was by marketing or just company policy it at least suggests they have one or two competent people over there.
your bank could sign it's own certificate, burn it onto an 80mm cd, then give it too you when you sign up for a bank account.
Now to perform a mitm attack you have to become a customer service rep at the bank branch of your intended victim.
I'm not a security expert and my crypto knowledge is limited. But from what I can understand, the general principle here is that trusting somebody unknown is considered more dangerous than not trusting somebody you know. In addition, the meaning of "trust" in the SSL context is that "you can trust me that anything that happens between me and you is encrypted, will stay between you and me, and nobody else can hear us". It's not "trust me, visiting my website won't harm your computer or your person". There has to be a way to ensure that your are using your Bank and not a fraudster or zombie system. SSL may not be perfect (considering it's several decades old) but it's a first step.
By the way, accepting a certificate by clicking OK is the equivalent of putting your signature on that site's terms of usage, not the other way around. So we'd better all read and learn more about it, it's not Mozilla's or the operating system's responsibility to teach us about it.
Why is everyone so afraid of being open? Maybe it's just part of the human condition.
We have little hope if even Mozilla leans towards nondisclosure.
Mozilla was the first browser vendor to patch. SURE they could have told us exactly what they were patching, but they erred on the side of caution. The fact that they want to be OPEN about everything is just a bonus and it's what differentiates Mozilla from every other browser vendor.
SSL seems fundamentally broken because it is.
Say a site devoted to dissidents, purchases a cert signing from some CA like Verisign.
Now, say your government, someone else's gov't, or some random corp has its own CA that is trusted by your browser. This government/corp wants to spy on your activity, so they gen a cert for dissidentsRus.org, and setup a transparent proxy to intercept your traffic. While they are at it, they setup the same for your bank.
Now, you visit dissidentsRus.org, and nothing looks odd on your browser, but your "encrypted and secure" traffic is being intercepted and unecrypted, in real time by some random gov't or corp. While they are at it, they decide to drain your bank account, since they were able to sniff your credentials the same way.
Yes, gov'ts and random corps run CAs that are trusted by the major browsers, so every time you use SSL, you are trusting _ALL_ these random corps and gov'ts that they are not trying to intercept your traffic.
As recent events demonstrated, the attacker doesn't even need to control the CA. Just rely on good 'ol social engineering and start siphoning bank accounts. Combined with DNS poisoning, and you can attack random folks anywhere you please.
requestpolicy extension for firefox helps to mitigate, but we really need something better than the trust model of SSL for asserting identity and encrypting traffic, that the mainstream can use.
Comment removed based on user account deletion
Most of this has been the work of Jacob Appelbaum, core member of the Tor project. He is the one who investigated the fraudulent certificates and it's a fascinating detective story.
Sig
SSL is fundamentally broken. It only allows one signature of a certificate. If it allowed multiple signatures, anyone could sign the certificate, and you could do stuff like check if your friends trust this certificate, or whether your bank does, and so on. Just like PGP/GPG.
Sensible sites would get their certificates signed by multiple authorities, and this would make it possible for browser users to disable e.g. Comodo certificates without losing access to a significant part of the WWW.
Finally! A year of moderation! Ready for 2019?