Slashdot Mirror
Chinese Certificate Authority CNNIC Is Dropped From Google Products
eldavojohn writes A couple weeks ago, Google contacted the CNNIC (China's CA) to alert them of a problem regarding the delegated power of issuing fraudulent certificates for domains (in fact this came to light after fraudulent certificates were issued for Google's domains). Following this, Google decided to remove the CNNIC Root and EV CA as trusted CAs in its Chrome browser and all Google products. Today, the CNNIC responded to Google: "1. The decision that Google has made is unacceptable and unintelligible to CNNIC, and meanwhile CNNIC sincerely urge that Google would take users' rights and interests into full consideration. 2. For the users that CNNIC has already issued the certificates to, we guarantee that your lawful rights and interests will not be affected." Mozilla is waiting to formulate a plan.
If a CA clearly can't be trusted, then it has absolutely no business being trusted. This is a good thing, and despite the upheaval it will cause for people requiring new certs (if you want chrome to like the site), it will only improve security by making CA's aware that if they mess about, or don't vet properly, then their business is basically gone.
Of course, the only really secure way is to drop all CA's everywhere, and directly exchange certs with whoever you deal with (banks, etc, etc by going into a branch. Hugely impractical though).
What 'rights and interests', exactly is CCIN blathering about? Google has changed absolutely nothing about any certain they have issued, the hierarchy will be precisely as it was, they just decided that 'being untrustworthy' was incompatible with being among the trusted CAs.
Is this just swagger, or are they attempting the theory that CAs have some sort of right to be trusted?
Given the events that transpired, it seems like Google is completely in the right here. It would be best if Mozilla, Microsoft, et. al. followed suit.
Google and Mozilla should just forbid any CAs from issuing CA certificates to anyone else that is not itself. This effectively means no sub-CAs on third-parties. There, fixed.
It is still utterly useless, the current CA model is not salvageable. Not even if we augment it with DNSSEC+DANE to enforce the trust chains for each domain.
And that's not even going into the nightmare that it will be to get the CDNs to behave, fixing it on their end will be either expensive as all heck, or unsafe as all heck.
Judging by the discussions on the Mozilla mailinglists I wouldn't be surprised if Firefox will include a whilelist of currently certificates issues by CCNIC and make it so no new certificates issues by CCNIC will be valid.
At least as long as they CCNIC doesn't adhere to the proper rules. Maybe CCNIC will even get stricter rules applied to them.
New things are always on the horizon
This plan does not need to be formulated. Drop their root CA ASAP.
What this summary neglects to say is that Google is open to the idea of adding them back. Quote (link mine):
[...] CNNIC will be working to prevent any future incidents. CNNIC will implement Certificate Transparency for all of their certificates prior to any request for reinclusion. We applaud CNNIC on their proactive steps, and welcome them to reapply once suitable technical and procedural controls are in place.
"The unauthorized certificates were issued by Egypt-based MCS Holdings, an intermediate certificate authority that operated under the authority of CNNIC. MCS used the certificates in a man-in-the-middle proxy, a device that intercepts secure connections by masquerading as the intended destination" Looks like Google and CNNIC have already agreed that if CNNIC are good boys for the next few weeks they wont turn them off. Wonder how closely MCS Holdings works with the Chinese gov?
Google announced the decision in an update at the bottom of https://googleonlinesecurity.blogspot.com/2015/03/maintaining-digital-certificate-security.html. I'm happy they did: certification authorities need to understand that there are consequences to gross negligence or worse.
There's a hidden treasure in Python 3.x: __prepare__()
But would they do the same if Verisign fucked up like that?
I commented on this in an earlier thread.
"Fix your shit once-and-for-all and we might deal with you again."
That's not really an endorsement, any way you look at it.
Web of trust cannot survive politics, if we tolerate any bad behavior from any trusted parties, then nobody could be trusted and whole construct falls apart.
What this summary neglects to say is that Google is open to the idea of adding them back. Quote (link mine):
[...] CNNIC will be working to prevent any future incidents. CNNIC will implement Certificate Transparency for all of their certificates prior to any request for reinclusion. We applaud CNNIC on their proactive steps, and welcome them to reapply once suitable technical and procedural controls are in place.
Ahahaha, this just says "basically before you can even talk to us again, you'll need to implement Certificate Transparency." That's not reinclusion, that's a requirement for you before you can request to be reincluded.
In China anyone can rip off or scam anyone, make a fake product, clone something, lie about specs, sell defective gear, etc.
"The decision that Google has made is unacceptable and unintelligible"
WELCOME TO AMERICA. We don't put up with that shit.
All this talk about Google and Mozilla, what is Microsoft doing?
California has been occupied since 1847. Shouldn't Google do something about that first?
I think we were fools to ever trust China in the first place. Now look at how indebted the US is to China. We are just as weak to China as we are to Iran. No leverage anymore because we have basically sold out in order to obtain goods at a better price and US companies can make bigger profits. Google certainly should be praised for its action, but let's also realize how China is slowing killing off any Western connections.
Um... no. China is a much, much, much bigger threat. Going to war with Iran would be like going to war with Maryland.
http://en.wikipedia.org/wiki/L...
http://en.wikipedia.org/wiki/L...
http://en.wikipedia.org/wiki/A...
http://en.wikipedia.org/wiki/P...
Obtaining actual physical goods for IOUs is a pretty good deal IMHO.
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
This is kind of equivalent to hiring a locksmith, then noticing that he copied one of your keys and it's on his personal keychain.
There is no reason to ever trust this locksmith again. Some institutions, like certificate authorities and locksmiths, are sacred. The whole POINT of their existence is to be an entity you can trust to keep things secure. If they are irresponsible and let this happen, then there's no reason to trust them.
Ever again.
...as trusted does.
The very fact that the security level becomes a battlefield between entities of different interests,
is telling plenty about how flawed the CA model -as implemented in modern browsers- was in the first place.
F.
Until we come up with a better fix for the whole CA system, browser support for DANE would be a huge step in the right direction. Especially, the type 2 (Trust anchor assertion) records would be helpful. So Google could say that only certificates issued by their own CA are legitimate. Or any site owner could publicly restrict trust to the CA that they actually get their certs from (or just specify a particular cert).
If you want a vision of the future, imagine a youtube comments section scrolling - forever.
be weasels, be labelled sneaky. I have no problems with this. the whole security thing needs a serious re-engineering. too many sneaky Petes hiding under the CA mechanism, and too many holes in our other security software systems.
if this is supposed to be a new economy, how come they still want my old fashioned money?
Going to war with Iran would be like going to war with Maryland.
You've never been to Maryland, have you? You'd never win such a war. There's too much paperwork involved in even establishing a war in Maryland. Just the recurring fees and annual compliance filings with the state would be enough to crush the fighting will of any invading army. Not to mention the tax rates on any pillaged loot seized during said invasion, especially in certain Maryland counties, would be enough to make the whole thing completely unprofitable. Just don't bother. Invade nearby Virginia, or maybe Delaware or Pennsylvania, instead. They're much easier to deal with.
Don't disappoint your bird dog. Go to the range.
While they don't have identical roles, it does sound like CNNIC is taking a page from the ICANN playbook by handing out more favors to better donors. Yet we trust the information that ICANN endorses...
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
So far I'm blocking
China Internet Network Information Center (its next to cnnic :) and I doubt I'll ever need to use it)
Chunghwa Telecom Co. (same)
CNNIC
SecureTrust Corporation (trustwave)
I'm looking to enlarge my list; any other certs I should be blocking as well?
Particularly when the IOUs are denominated in dollars and you control the printing press for dollars.
Chinese companies are inherently corrupt anyway, so what does it matter?
Honeybadger can't not give a shit forever...
If they are doing shady stuff with certificates (obviously issuing fraudulent ones to the gov't hackers to use) then they don't deserve to be trusted. Eff em all.
If you owe the bank $1,000, you have a problem.
If you owe the bank $1,000,000, the bank has a problem.
Prove anything by multiplying Huge Number times Tiny Number
the 1st of April, so yay or nay on this being an epic April fools that duped the CNNIC as well?
There was an article in 2010 about this subject and the naysayers were correct.
http://slashdot.org/story/1308...
I've personally deleted its authority entry in Firefox.
"Fool me once. Shame on you..." and all that.
I can't tell if these people are just blustering and trying to save face, or if they are actually really so stupid and morally bankrupt that they don't see fraud as bad.
I have no problem with this, if the CA can't be trusted than they should be de-listed from browser default behavior as soon as possible.
However, I do see the Chinese government reacting in a particular way. They could start requiring that _only_ government approved CA are used within China's borders (with the little detail of Google's certs not be accepted / listed).
This is an epic thread.. amusing.. and very sad.. at the same time..
https://bugzilla.mozilla.org/s...
However I'm afraid we often are not understanding the bigger picture.
The underlying problem is our own behavior. We are hoisting responsibility for security of everything in the "cyber world" upon CAs and acting surprised when the tidal wave of pressure from all sources to betray that trust washes them away.
Trusted third parties should be used only for initially establishing trust... after that we should be finding off-ramps and decentralizing trust as much and as quickly as possible. The goal is to reduce "tidal waves" of incentive to something more manageable by reducing the reasons for wanting to compromise these systems in the first place.
For example while I am creating my gmail account I should be able to establish a separate trust relationship (password...etc) with Google that does not depend on third party CAs. A PAKE algorithm (TLS-SRP) would fit the bill nicely here.
Later even if some government wanted to clamp down or spy on everyone compromising PKI does not result in compromise of users... and better still the offloaded trust can be used to crosscheck PKI detecting intrusions quickly.
This is critically important because not only will the pay out for successful compromise be relegated to "new users" but your chance of being caught in the act instantly goes up to 100%.
Why not implement some sort of verification server that can verify the cert that you are given, and ties into DNS.
It could go like this -
1. User goes to https://google.com
2. Browser gets cert from https://google.com
3. Browser checks if cert matches local store of verified certs. If pass goto 5, if fail goto 4.
4. Browser checks DNS of google.com for the CVS (cert verification server) and checks if the cert that was received in step 2 matches. If pass save cert to local store, if fail error 403.
5. Profit!!
The local store is optional but provides quicker response, but should have a drop off after a set time. The above system does need some fixes, like if you are dealing with a compromised DNS server, but would also allow self-signed certs to verify.
Hell, google and firefox and others could implement this in their browsers now, and just verify the certs to their own servers for what others have verifyed before (think AcoustID type system).
Suck it bitches!
This problem is in the same ballpark as spam. There is clear black and white. But because there are so many levels of grey you cannot draw a line anymore. You need to device a mechanism that will allow you to do that again. That means you have to be able to identify the individual actors again (instead of intermediaries). The actors need to have an interest to keep up their reputation.
Maybe all you need is an ssl certificate that can be validated by DNS (but not created)?
Yes, exactly. And on top of it all, ultimately dollars are only good for purchasing US goods and services. So at some point - admittedly it could be far in the future - those dollars will presumably help support American jobs.
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
It seems that Mozilla will also be dropping CCNIC..
This post is encrypted twice with ROT-13. Documenting or attempting to crack this encryption is illegal.
Well, google seems a bit over-reacting. According to http://www.theregister.co.uk/2015/04/02/google_furious_dodgy_chinese_certs_cnnic_chrome_warning/,
Adam Langley, a security engineer at the Chocolate Factory, wrote that Google had become aware of unauthorised certificates issued by an intermediate certificate authority "apparently held by a company called MCS Holdings", adding that the "intermediate certificate was issued by CNNIC."
The Chocolate Factory state that "While neither we nor CNNIC believe any further unauthorized digital certificates have been issued, nor do we believe the misissued certificates were used outside the limited scope of MCS Holdings’ test network. CNNIC will be working to prevent any future incidents."
Why use the dollars to support foreign (to them) jobs, when they can just use them to purchase resources, companies, etc. True some minimal number of jobs will be involved in that, but any labor intensive processes can be shipped back home.
So its not just "jobs in the far future" it's "strip mine the country when convenient".
I think we've pushed this "anyone can grow up to be president" thing too far.
Virginia's light on the paperwork, but the people there can actually shoot back.
Also, avoid Pennsylvania - you might win, and then Pittsburg would belong to you!
Might wanna look elsewhere, Virginia has all the pretty toys.
My Dear user,
As you may no, our top certificate signing program is being droped from Majer browsers in 60 days.
Please follow *this* link for having a certificate signed by new top authoritarian.
If asks you for account numbers, this is normal and safe (see this green securely signed certificate indicator in address bar!).
Best Wishes,
Your'e esteamed provider.
Resources == Jobs. Companies are nothing but collections of people. Even real estate is an almost infinite resource in the US. I'm not going to say that running a constant deficit is a good thing, but we could do far worse than to have another country lend us a bunch of our own currency at a rate below inflation.
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
Why cant we request all trusted CA to publish all issued and still valid certs ( in form of list or by some protocol) ? Then we can crawl those lists or search for our domain or wildcards or....
Sorry, but resources are not identical to jobs, and there is not constant relation between them. If all you do is use robots to mine the ore and ship it to China, yes, a FEW jobs will be involved, not many.
When Lenovo bought IBM ThinkPad division, do you think that the people who worked there continued to work there? Well, they did for awhile, during the transition. They don't anymore. If they're lucky they work for IBM. But that's a very big if.
I'll agree this much. Part of what makes a company is the people. In particular the people hold much of the knowlege. But often the right to use that knowlege is held by the company itself, not by the people. This is certainly true in the case of patents, copyrights, trademarks, trade secrets, etc. So when the company is sold, the people working ther have a "duty" to share the knowlege with the new owners. They may also continue to have jobs, but often this will mean relocating. Sometimes it means training someone else to do the job you currently hold.
You seem to be sincere, but to have a radically oversimplified idea of how economics, companies, etc. work.
I think we've pushed this "anyone can grow up to be president" thing too far.
Resources may not make enough jobs to keep you happy, but it does provide jobs - and good ones at that. Look at the boon to the Texas economy from fracking.
Lenovo may not be the best example for you to use, since Thinkpads were already manufactured overseas. But I take your point - sometimes a purchase is just the brand name, and the jobs go up in a puff of smoke. But to be honest, those cases are usually fire sales where the company is on its last legs anyway. Think Palm or AMC.
I agree that my posts are radically simplified. They spent over an hour talking about this on a recent NPR show, and they barely scratched the surface. Nevertheless, I stand by my narrative that owing the Chinese government over a trillion dollars is not as incredibly horrible as it would seem at first blush.
W..w..W - Willy Waterloo washes Warren Wiggins who is washing Waldo Woo.
NEVER trust a Chinese. I would know. I am Chinese.