Slashdot Mirror
India's National Informatics Centre Forged Google SSL Certificates
NotInHere (3654617) writes As Google writes on its Online Security Blog, the National Informatics Centre of India (NIC) used its intermediate CA certificate, issued by Indian CCA, to issue several unauthorized certificates for Google domains, allowing it to do Man in the middle attacks. Possible impact however is limited, as, according to Google, the root certificates for the CA were only installed on Windows, which Firefox doesn't use — and for the Chrom{e,ium} browser, the CA for important Google domains is pinned to the Google CA. According to its website, the NIC CA has suspended certificate issuance, and according to Google, its root certificates were revoked by Indian CCA.
Will there be any repercussions for this?
The National Informatics Centre of India did abuse something.
Will the National Informatics Centre of India be able to continue with such abuses and do this again in the future?
Or will they lose this ability?
What will happen now?
They have shown that they can not be trusted. They must lose the power to do this.
Pull someones certificates or kill some CA. Someone needs to suffer because of this.
The NSA?
Why is Snark Required?
Good old Indian "ethics".
The whole point of issuing certs is to be a trusted third party. No one is going accept a cert from them again. They should know better.
So SSL is nothing more than an honor system? Fuck that. Security , such as it was, is utterly fucked now that any tin-pot government quango can start intercepting.
Says the random turd hiding behind a pseudonym. Sign your post with your real name, address and SSN and then you can call for "anonymous" posting to be abolished.
Funny, I looked up "Assmasher" in the White Pages and various international name lookup services and didn't get a single hit. It's almost as if you're hiding your identity no differently than the very ACs that you proclaim to want to be abolished. Man up and give us all your personal details or STFU.
I was gonna say set your preferences to -5 AC posts, but I can't find the setting at the moment - did they get rid of it for beta? Somebody probably can post the link to the scoring prefs.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Wow, I guess the guys who built /. who thought AC should stand for "Anonymous Coward" didn't know that "Desler" knows best and that and AC and a registered user are exactly the same thing. Wonder why they bothered with creating the AC system? Idiots. Really. I mean, they should have just asked you obviously.
Ignoring the rest of the stupidity of what you posted, maybe you could come to realize that the difference between AC and a registered user is that registered users can develop a reputation for their behavior; i.e., a user that posts stupid things like
Man up and give us all your personal details or STFU
can become known for being an ignorant hothead.
They're called "Anonymous Coward" for a reason.
Loading...
Pseudonyms exist to protect people from the rabid - like yourself.
Think about the stupidity of comparing the establishment of a pseudonym to posting your SSN? LOL.
Loading...
The difference between India and some other countries is that India is 2nd-rated enough to be caught immediately when they do something like this. That makes them more stupid, but less of a threat than, say, the US.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
How does having a registered account mean anything? You can register one with a throwaway email account. Plus many registered people do use AC from time to time.
Because it's a pain to do so. It helps cut down on the DB anonymous posting. You can quickly discern if they're schills, flametards, et cetera.
I agree, I post on occasion as AC when I'm on another device, and like I said, I never had any problem with people posting AC until the past few years when people seem to be using it to simply spam /. with total garbage, or hatred, et cetera.
Loading...
And these are our "friends"? How much IT and other activities have we sent off to China and India? And what do we, our government and and our corporations get in return? Intellectual theft, data theft, subversion. And the we spy on our supposed allies.
Pseudonyms exist to protect people from the rabid - like yourself.
So does AC since it is also a pseudonym.
Think about the stupidity of comparing the establishment of a pseudonym to posting your SSN? LOL.
What is stupid about it? You appear to hate anonymity yet use a fake name to hide your identity. Sign your work and stop being a hypocrite.
It sounds like we need the ability to limit the scope of certificate authorities to signing for only certain domains.
While it isn't a perfect solution to the broken CA model, it would prevent cases like this one and limit the damage that could be done.
Somebody probably can post the link to the scoring prefs.
https://slashdot.org/users.pl?op=editcomm
Or you can click on one of the "edit" links in the score details window.
"The state is that great fiction by which everyone tries to live at the expense of everyone else." - Bastiat
Because it's a pain to do so
Yeah clicking a button and typing a couple dozen characters is sooo hard. Registration takes less than 5 minutes in total.
This is a big deal. If you use a browser on Windows that does NOT counter this, such as Internet Explorer, then you ARE vulnerable. I imagine Microsoft will come out with a special-purpose patch, but still, this is a pretty nasty issue.
Untrustworthy CAs have been a problem for a long time; we need mechanisms to address them. The terrible cert revocation system makes it even worse; you can't be sure that the certs are checked in many cases. Chrome's CRLSets are not the answer; they are not even the beginning of an answer. We need to fix the whole revocation system. Sadly, there hasn't been enough work or enough urgency on these problems; maybe this will light a fire under those efforts. I doubt it, but it's worth hoping.
- David A. Wheeler (see my Secure Programming HOWTO)
They preach everyone is all the same because in reality the truth is embarrassing.
Calling the corrupt as honorable as someone with honor is actually an insult to the honorable. We put effort into being good people and maintaining our cities. Here in Detroit where it's segregated you can really tell just by looking at yard maintenance.
Why should I paint my house, replace siding, mow my grass regularly, if some religious tool will simply tell everyone that the other idiots who let their city rot are just as good as me?
No, I work hard to maintain my upper class image. I deserve to be able to use it!
Some people have a "Homepage" link at the top of each of their posts that points to old-media contact info.
If you're juding the message by the source, you are generalizing. Perhaps that generalization beneifts you, but keep in mind that it's not always what you know that is most damaging, it's what you don't know. Heavy filtering based on assumptions of the message concoted by who originated it is something that can easily backfire.
Doesn't it require a valid e-mail address and confirmation first? It certainly used to.
Loading...
5 minutes is a lot of time for the people who go around spouting hatred and ugliness all over internet forums. This is why the don't register, because it's not worth the effort - especially when they get banned - especially if that ban is by IP.
Loading...
The United States Department of Commerce has been doing this for years.
...to sanitation as to the myriad of silly, pissing contest undertakings they seem to have a penchant for, India would be a better, less stinky place.
It's not the race as much as the culture. A culture that doesn't value honest dealings with outsiders will produce crooks. I lack the experience to name any names, so is there anything specific in the culture of India or the Jewish diaspora that might produce such dishonesty?
No it's not.
This is why I do not trust any CA's included in any browser, instead preferring to validate those few sites I actually use HTTPS with. The other advantage is that none of the god damn advertisers can use an https connection to pass on malware since the certs aren't trusted by me. Blocks em right at the source.
captcha=despised
I think intermediate CA certificates issued to certificate vendors, ISPs, governments, should all have name constraints so that they can be used to sign only certificates for an appropriate part of the namespace.
http://tools.ietf.org/html/rfc...
This is not a problem with Firefox, SeaMonkey, or other Mozilla-based applications. They use a certificate database separate from Microsoft's, a database that does not contain the certificate used in the forgery.
The certification authority at fault (NIC) has an open request to have its root certificate added to Mozilla's database. However, NIC has failed to respond to requests for further information, requested over a year ago by the Mozilla person who is in charge of the process of approving certificates. Furthermore, Mozilla persons -- both staff and users -- are aware of NIC's problem; some have suggested that NIC's request be rejected and NIC be permanently banned from the database.
To see the discussion, see https://bugzilla.mozilla.org/s....
Some certification authorities and some of their subscribers complain that Mozilla takes too long to approve root certificates and then to add those certificates to Mozilla's database. At least in this case, delay served to protect users. The delays are significantly caused by Mozilla's requirement for independent audit reports and for a period of public review and comment on each request. Hooray for Mozilla!!
Re: "No one is going accept a cert from them again."
Really? I mean, at an administrative level, well some admins might kick up a fuss. Lots of others won't though.
At a personal level software regularly asks me if I want to "Accept all trusted certs" or "Just this cert". I've tried individual acceptances but it's slow and I never have any sound basis for rejecting one. Even the certs with problems, have you ever dealt with that? I get that all the time.
Most of the time cert problems are expired certs and how do you evaluate that? Most of the time it's just an admin who didn't renew in time. Or a name change. And the names, they are often terrible. And you never get any information beyond the internal system name. Where is the name and address of the applicant? How about an e-mail address and phone number? How about a reputational rating? How about a confidence level that the issuer has in the information? Something that human beings can understand? Anything??
I for one absolutely hate the user experience of the certificate system. It's profoundly broken.
Pointer???
We gotta move to encryption that is free. Does not rely on a root server and which works between client and client. .
Like gpg or something or a new protocol to pass a connector the public key to which the connectee also gets the clients public key. Then the two start encrypted communication with no man in the middle and no need to pay a lick for a certificate.
And encryption should be standard and not optional .. To prevent signal eavesdropping .
Finally cables need quantum shielding as do CPUs, dram, bus, and even the human brain so nothing can be intercepted.
I hear too that you need a superconducting shield to deflect and block 100% of signals.. Prevent remote control and remote reading.
Kick them off the Internet. All of them. That's the only the appropriate punishment.