Slashdot Mirror
Apple Leaves Chinese CNNIC Root In OS X and iOS Trusted Stores
Trailrunner7 writes When it was revealed late last month that a Chinese certificate authority had allowed an intermediate CA to issue unauthorized certificates for some Google domains, both Google and Mozilla reacted quickly and dropped trust in CNNIC altogether. Apple on Wednesday released major security upgrades for both of its operating systems, and the root certificate for CNNIC, the Chinese CA at the heart of the controversy, remains in the trusted stores for iOS and OS X. The company has not made any public statements on the incident or the continued inclusion of CNNIC's certificates in the trusted stores.
How many Apples are there?
Hey, they weren't spying on our SSLed services today, so we still totally trust them! Also, have you seen how lucrative the Chinese market could be?
Apple is worried that doing the right thing will make them loose market share in China.
Given that CNNIC is a Chinese CA, does that mean that users that are not in China and not visits Chinese web sites safe?
For fuck's sake is it really that hard to at least proofread the headline? "Apples Leaves Chinese CNNIC Root In OS X and iOS Trusted Stores"
Remember that unlike Google, Apple has deep manufacturing and retail ties into the Chinese market, which is seen as a key strategic part of cost management and future market/revenue expansion.
Even though CNNIC is very cozy with the Chinese MSS and the variety of PLA workforces associated with externally focused compromise, it is an organ of the Chinese government, which works differently from many others. If you were to offend the quasi-governmental agencies that deal IPs and such things in the US, you might not get "favorable" treatment, but the US FTC and others aren't exactly likely to swoop in and close you down either.
China has shown with Google and Twitter and others that if you aren't willing to play ball with their government, they have enough control over everything that they can effectively disadvantage you in the market. They can arbitrarily sieze assets, justice is somewhat malleable, and the Great Firewall means no matter how big you are, entire segments of you traffic base can be reduced because the average person isn't going to work hard to get around the censors.
The last thing Apple needs right now is to create another "front" to wrestle with a government on in such a strategic market. Even if the truth is that CNNIC probably isn't really the most trustworthy "root" in the world. But its also hard to blame them when the Snowden revelations have revealed that certain types of exported hardware devices could be diverted in the shipping process, etc, etc.
China's vociferous response to Google removing CNNIC's root certificate authority is the reason Apple is not taking action. Apple is a very principled company until those principles start costing them money.
Anyone know if I can remove the CA myself?
TFA calls it "an unusually severe punishment by both Google and Mozilla." Presumably there are many, many people relying on perfectly valid CNNIC certificates and typically the actions of one rogue intermediate CA doesn't require burning things to the ground (of course if it happens again, then you can no longer call it a mistake). TFA also notes in the very last line Microsoft didn't pull CNNIC either, but the headline and 99% of the article makes no mention of that.
My Grandmother (she is 85) has an Intel based Core Duo Macbook and Apple has stopped providing security updates. Each time I visit her, I try and update the machine, and the only update available is a huge update for iTunes. Thanks Apple!
When we bought the machine (new) I thought the macbook would be more usable for her than a Linux laptop. While it has been a good machine, being orphaned on security updates is bad form by Apple.
Spending over a thousand bucks on a new Mac isn't going to happen.
If u read the article, it seems like Google is politicking the issues, given that it is not CNNIC but an intermediary that is at fault. For once, Microsoft seems to have done the right thing.
We are talking apple users here, not Linux users. All three Apple users who know these steps have probably already done so. The other several hundred million are fucked, and Apple has now publicly taken a stance that they plan to hang those millions out to dry.
Ironically, I was going to buy an apple laptop for sheer convenience (and to run more recent versions of scrivener), but now I most certainly won't. Time to research good Linux laptop alternatives instead (ideally with high-end graphics capabilities that support blender's cycles module ... wonder how well Optimus is supported these days). Oh well, it will probably be cheaper anyway. Maybe I can treat myself a 4k monitor with the money saved.
The Future of Human Evolution: Autonomy
They could have done the right thing here. Our entire vapourous internet security depends upon the root CA system. I'm glad Google and Mozilla have taken a hard stand.
OSX is now officially the most insecure, if for no other reason than the H1B fuck ups.
"If any question why we died, Tell them because our fathers lied."
My Grandmother (she is 85) has an Intel based Core Duo Macbook and Apple has stopped providing security updates [...] When we bought the machine (new) I thought the macbook would be more usable for her than a Linux laptop. While it has been a good machine, being orphaned on security updates is bad form by Apple.
It's not too late:
http://www.odi.ch/prog/macbook...
http://www.codingepiphany.com/...
The Future of Human Evolution: Autonomy
The Dell XPS 13 was released today.
If Apple's recent stream of security failures has not convinced you to switch to Linux or BSD, you are basically hopeless.
Intel Core Duo Macbooks were ONLY sold in early 2006 - late 2006, they went to Core 2 Duo.
If she has a Core 2 Duo Macbook, then she can upgrade to Lion, which had security updates at least through end of 2014.
Your dear auld gramma has a 9 year old computer, and should probably think about buying something new. She's had 9 years to save up since she bought that "new" macbook.
How do I remove this CA from my macbook?
sudo security find-certificate -a -Z -c "CNNIC ROOT" /System/Library/Keychains/SystemRootCertificates.keychain | grep SHA-1 /System/Library/Keychains/SystemRootCertificates.keychain
sudo security delete-certificate -t -Z 8BAF4C9B1DF02A92F7DA128EB91BACF498604B6F
When I was looking at trying to get back into creative writing, I looked at Scrivener. It's a nice app, but I already had online services I liked for notes and research, mainly Evernote and Trello, and it didn't seem to have good options for integrating with them.
Turns out, Emacs does all that stuff. All it costs is your sanity an assload of time to learn.
Also, Optimus is kinda-sorta okay. There's a utility called Bumblebee that handles turning the Nvidia chip on and off, and you basically end up running a second X session on the Nvidia with the output piped into the normal session. It's done by launching any app you want to be on the GPU with a wrapper app like Optirun.
What does this button d$#%* NO CARRIER
Or install Linux/BSD on it. It's not like you can't.
My Grandmother (she is 85) has an Intel based Core Duo Macbook and Apple has stopped providing security updates. Each time I visit her, I try and update the machine, and the only update available is a huge update for iTunes. Thanks Apple!
When we bought the machine (new) I thought the macbook would be more usable for her than a Linux laptop. While it has been a good machine, being orphaned on security updates is bad form by Apple.
Spending over a thousand bucks on a new Mac isn't going to happen.
So, the issue with the model of the Macbook you are referring to with a Core Duo (a chip that came out circa 2005) is that it is a 32 bit only CPU and the graphics chipset is too old to support any kind of hardware acceleration that the OS requires..
This model had security updates until mid last year, when the hardware was over 8 years old. Any mac built in 2009 or later (6 years old) can upgrade to Yosemite for free. In fact, there are my iMac produced in 2007 runs Yosemite.
I think that having a 9 year old piece of hardware that still runs well, is pretty good. I think you would be in the same boat with about any laptop that has a Core Duo CPU and Intel GMA945 or GMA950 graphics to run the latest and greatest OSes.
Open Keychain Access, find the System Roots keychain (left side), look for "China Internet Network Information Centre EV Certificates Root" on the right side, double-click on that. In the window this opens, expand the "Trust" arrow and change "When using this certificate" to "Never Trust".
Do the same for the "CNNIC Root" certificate.
"For a successful technology, reality must take precedence over public relations, for Nature cannot be fooled"
Are you sure? Have you performed a double blind study to determine that is performs better than placebo, and how much better to determine that it is the best?
APK likes to ask for responses to the same things over and over. Maybe he just likes the responses?
Apple will surely be updating shortly to close the loophole that has people installing PopcornTime on their iPhones...
Link
I'm surprised this isn't bigger news.
I'm on the fence as to whether my next laptop will be a Macbook. I'm not up on messing with security certificates. It took me about 10 seconds to get from Anonymous Coward's tip to a blocked CNNIC certificate. I think that it's within the scope of regular users. My cousin just did it, and she runs a modeling agency and was trained in, well, modeling. Macs do have a pretty easy interface. Say what you will, but that allowed me to do my little thing and get back to wasting time on the internet instead of grading papers.
If Apple's recent stream of security failures has not convinced you to switch to Linux or BSD, you are basically hopeless.
Oh, I've been running Linux for years and years. I was going to dual-boot an apple laptop with osx+linux, but now I have no interest in having osx any more than I do windows. I'll take a look at the new dell.
The Future of Human Evolution: Autonomy
Nice, thanks for the info. Nvidia would be nice, as I want to run blender. Is there a good comparison site for various laptops with high-end graphics and CPUs you know of? I've been poking around online for a while, but determining what the best supported higher-end laptops are for Linux is far from easy.
The Future of Human Evolution: Autonomy
Something similar happened to DigiNotar in 2011. They did not have any big brother protecting them, so they went bust in 1 week.
The only thing to do is to go public with the problem and issue new certificates back to the level above the fake cert.
We just had to renew our root CA which ment all customers had to get new certificates installed before the expire date.
This process has been a yearly long process and we bugged all customers by letter,email and probe their public sites until they have changed it.
The process itself is just running one executable containing the script with correct permissions on the server.
Yeah. Because it's SOOO hard to use Firefox, or Chrome, instead of Safari.
That's really how you do it - if it means that much to you, then you can always use browsers that do not use the OS X security store.
Like Chrome and Firefox. They run great on OS X.
Of course, a big problem is that Apple sells a lot of product in China, so CNNIC is pretty much required otherwise no Chinese user will be able to do anything.
I mean, what about Android? Is CNNIC going to be removed from it?
Meantime, I can run a supported version of Windows on PCs, even laptops, that are 10+ years old. (If I need to, I mean. Linux would be my first choice for performance reasons.)
But if you're rich enough to buy a Mac in the first place, you should be able to afford to replace it every few years, IMO.
IIRC, when Google announced that they were removing the certificate, they referred to specific terms in CNNIC's contract with them that had been violated. Not sure about Mozilla.
Does CNNIC have similar contracts with Apple and Microsoft? Do they have similar terms? It occurs to me that they might not be as rigorous, because they might have been drafted several years earlier than Google's one - seeing as Chrome is a relative newcomer.
... evil as possible. There are fake certs for Google, and Apple refuses to protect their users against them. That's pretty much the internet company version of sending machetes to ISIS.
fake certs from them. Did Apple do even that?
I am Chinese and I am happy to see they remove CNNIC certs.If Apple don't do this, I wouldn't buy apple's products any more.
Never trust a chinese. I should know. I am a chinese myself.
Is there a way for individual users to remove certs from these browsers without waiting for vendors to do so?
So if it’s a MacBook not MacBook Pro, and Core Duo not Core Duo 2, you’re complaint is about a machine that last shipped in 2006. Come on. 9 years ago? She was barely 76 when that machine was new.