Slashdot Mirror
Apple Leaves Chinese CNNIC Root In OS X and iOS Trusted Stores
Trailrunner7 writes When it was revealed late last month that a Chinese certificate authority had allowed an intermediate CA to issue unauthorized certificates for some Google domains, both Google and Mozilla reacted quickly and dropped trust in CNNIC altogether. Apple on Wednesday released major security upgrades for both of its operating systems, and the root certificate for CNNIC, the Chinese CA at the heart of the controversy, remains in the trusted stores for iOS and OS X. The company has not made any public statements on the incident or the continued inclusion of CNNIC's certificates in the trusted stores.
Hey, they weren't spying on our SSLed services today, so we still totally trust them! Also, have you seen how lucrative the Chinese market could be?
Apple is worried that doing the right thing will make them loose market share in China.
For fuck's sake is it really that hard to at least proofread the headline? "Apples Leaves Chinese CNNIC Root In OS X and iOS Trusted Stores"
It only takes one bad "Apples" to spoil the whole headline.
XML is like violence. If it doesn't solve your problem, you're not using enough of it. --AC
Well, there's Applejack, Apple Bloom, Big McIntosh, and Granny Smith.
Get free satoshi (Bitcoin) and Dogecoins
Remember that unlike Google, Apple has deep manufacturing and retail ties into the Chinese market, which is seen as a key strategic part of cost management and future market/revenue expansion.
Even though CNNIC is very cozy with the Chinese MSS and the variety of PLA workforces associated with externally focused compromise, it is an organ of the Chinese government, which works differently from many others. If you were to offend the quasi-governmental agencies that deal IPs and such things in the US, you might not get "favorable" treatment, but the US FTC and others aren't exactly likely to swoop in and close you down either.
China has shown with Google and Twitter and others that if you aren't willing to play ball with their government, they have enough control over everything that they can effectively disadvantage you in the market. They can arbitrarily sieze assets, justice is somewhat malleable, and the Great Firewall means no matter how big you are, entire segments of you traffic base can be reduced because the average person isn't going to work hard to get around the censors.
The last thing Apple needs right now is to create another "front" to wrestle with a government on in such a strategic market. Even if the truth is that CNNIC probably isn't really the most trustworthy "root" in the world. But its also hard to blame them when the Snowden revelations have revealed that certain types of exported hardware devices could be diverted in the shipping process, etc, etc.
CNNIC was found to have provided fake certs for popular sites, seemingly to aid with spying. So the answer is yes, this does affect people outside of China.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
China's vociferous response to Google removing CNNIC's root certificate authority is the reason Apple is not taking action. Apple is a very principled company until those principles start costing them money.
No. Any root CA (or anyone holding an intermediate CA cert with a trust chain back to a root) can sign a certificate for any domain at all.
That's right; the Belgian Government can sign for www.yoursite.com and the person who holds the key for that CSR can MITM anyone who visits www.yoursite.com with no certificate warnings raised.
TFA calls it "an unusually severe punishment by both Google and Mozilla." Presumably there are many, many people relying on perfectly valid CNNIC certificates and typically the actions of one rogue intermediate CA doesn't require burning things to the ground (of course if it happens again, then you can no longer call it a mistake). TFA also notes in the very last line Microsoft didn't pull CNNIC either, but the headline and 99% of the article makes no mention of that.
We are talking apple users here, not Linux users. All three Apple users who know these steps have probably already done so. The other several hundred million are fucked, and Apple has now publicly taken a stance that they plan to hang those millions out to dry.
Ironically, I was going to buy an apple laptop for sheer convenience (and to run more recent versions of scrivener), but now I most certainly won't. Time to research good Linux laptop alternatives instead (ideally with high-end graphics capabilities that support blender's cycles module ... wonder how well Optimus is supported these days). Oh well, it will probably be cheaper anyway. Maybe I can treat myself a 4k monitor with the money saved.
The Future of Human Evolution: Autonomy
This confirms the absolute uselessness of this whole 'certificate' thing, except for tracking purposes of course.
“He’s not deformed, he’s just drunk!”
My Grandmother (she is 85) has an Intel based Core Duo Macbook and Apple has stopped providing security updates [...] When we bought the machine (new) I thought the macbook would be more usable for her than a Linux laptop. While it has been a good machine, being orphaned on security updates is bad form by Apple.
It's not too late:
http://www.odi.ch/prog/macbook...
http://www.codingepiphany.com/...
The Future of Human Evolution: Autonomy
They apparently *really* don't want me to get rid of it:
+ grep SHA-1 /System/Library/Keychains/SystemRootCertificates.keychain /System/Library/Keychains/SystemRootCertificates.keychain /System/Library/Keychains/SystemRootCertificates.keychain /System/Library/Keychains/SystemRootCertificates.keychain
+ security find-certificate -a -Z -c 'CNNIC ROOT'
SHA-1 hash: 8BAF4C9B1DF02A92F7DA128EB91BACF498604B6F
+ security delete-certificate -t -Z 8BAF4C9B1DF02A92F7DA128EB91BACF498604B6F
security: SecTrustSettingsRemoveTrustSettings (user): No Trust Settings were found.
+ security delete-certificate -t -c 'CNNIC ROOT'
x: line 5: 92884 Segmentation fault security delete-certificate -t -c "CNNIC ROOT"
Open Keychain Access, find the System Roots keychain (left side), look for "China Internet Network Information Centre EV Certificates Root" on the right side, double-click on that. In the window this opens, expand the "Trust" arrow and change "When using this certificate" to "Never Trust".
Do the same for the "CNNIC Root" certificate.
"For a successful technology, reality must take precedence over public relations, for Nature cannot be fooled"
Except, the way SSL works, you have to remove the CA until the CA revokes the Intermediate CA's authority, or people are open to MITM attacks. Google did absolutely the correct thing, and MS and Apple are failing at security. There is no other right thing here. Once the intermediate is blocked, then you can say Google is in the wrong if they don't reinstate the CA's cert.
APK likes to ask for responses to the same things over and over. Maybe he just likes the responses?
Are you sure? Have you performed a double blind study to determine that is performs better than placebo, and how much better to determine that it is the best?
APK likes to ask for responses to the same things over and over. Maybe he just likes the responses?
Apple will surely be updating shortly to close the loophole that has people installing PopcornTime on their iPhones...
Link
I'm surprised this isn't bigger news.
This confirms the absolute uselessness of this whole 'certificate' thing, except for tracking purposes of course.
It's not useless, but it's only half of the equation.
The cert says, "we trust that this site belongs to this entity". That's one-way.
What needs to happen is that sites need to publish in their DNS(SEC) that they trust the same CA(s). That completes the mutual agreement on trust, which is currently missing. There are a few competing RFC's on the best way to lay this out, but what CNNIC shows is that we need to stop bickering and deploy this yesterday, accepting that "good enough" may not be perfect but it's *way* better than nothing. 'Better' is what version 2 is for.
May we engineers save us from ourselves.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
No. Any root CA (or anyone holding an intermediate CA cert with a trust chain back to a root) can sign a certificate for any domain at all.
Even worse, there is no way to know which certs you need and which you can get rid of. This question has remained open on Super User without a good answer for over half a year:
http://superuser.com/questions...
It is dangerous to be right when the government is wrong.