Slashdot Mirror
Mozilla Might Distrust Dutch Government Certs Over 'False Keys' (bleepingcomputer.com)
Long-time Slashdot reader Artem Tashkinov quotes BleepingComputer:
Mozilla engineers are discussing plans to remove support for a state-operated Dutch TLS/HTTPS provider after the Dutch government has voted a new law that grants local authorities the power to intercept Internet communications using "false keys". If the plan is approved, Firefox will not trust certificates issued by the Staat der Nederlanden (State of the Netherlands) Certificate Authority (CA)...
This new law gives Dutch authorities the powers to intercept and analyze Internet traffic. While other countries have similar laws, what makes this one special is that authorities will have authorization to carry out covert technical attacks to access encrypted traffic. Such covert technical capabilities include the use of "false keys," as mentioned in Article 45 1.b, a broad term that includes TLS certificates.
"Fears arise of mass Dutch Internet surveillance," reads a subhead on the article, citing a bug report which notes, among other things, the potential for man-in-the-middle attacks and the fact that the Netherlands hosts a major internet transit point.
This new law gives Dutch authorities the powers to intercept and analyze Internet traffic. While other countries have similar laws, what makes this one special is that authorities will have authorization to carry out covert technical attacks to access encrypted traffic. Such covert technical capabilities include the use of "false keys," as mentioned in Article 45 1.b, a broad term that includes TLS certificates.
"Fears arise of mass Dutch Internet surveillance," reads a subhead on the article, citing a bug report which notes, among other things, the potential for man-in-the-middle attacks and the fact that the Netherlands hosts a major internet transit point.
This is a tough question, because arguably corporate-held keys aren't trustworthy either, but if we are to trust government keys, we need to know what the terms of governance are, and in general we don't. In the U.S., for example, government eavesdropping rules are secret. So trusting a PKI cert issued by the U.S. government is crazy. Of course, governments can also often compel private industry, and as we've seen, private industry can also engage in corrupt practices or careless practices. Honestly, PKI is pretty rickety.
... was breathless bullcrap by bleepingcomputer.
What a wasteland.
This is what happens when you try to pull a stunt like this.
Certificates are based on a system of trust. I trust a certificate because the issuer promises that it belongs to the party it was issued to. If that party now not only has the ability but also the obvious intent to intercept and snoop on traffic, the certificate is intrinsically untrustworthy. Because it can easily be used for such nefarious applications.
The Netherlands just made all their certificates along with every certificate issuing company under their jurisdiction untrustworthy.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Btw, Netherlands will hold a referendum on this new surveillance law, so Mozilla's action is warranted https://www.reuters.com/articl...
We have been existing for a long time without https, but now we want a certificate for everything, even places where is trust isnâ(TM)t needed. One of the issues I see is that there is a difference between trust and encryption, but the average user may not make the distinction.
Also, to the average user it isnâ(TM)t clear who the third party they are trusting is and whether they are any more trustworthy. This leads to the risk of blind trust and the consequences that go with it. A bit like afreeing to a EULA, without reading it.
Jumpstart the tartan drive.
So far this law is a proposal and it needs to be passed by parliament.
After some seven months of negotiations we've (the Dutch) just received a new coalition government based on four parties.
For some inexplicable reason they all believe this is a good plan though it looks like majority of the population is not convinced.
An advisory referendum will be held but one of the larger parties already announced they would ignore the outcome.
This government has a parliamentary majority of one and I would be surprised if they can pass this law without serious amendments.
Now I'm absolutely sure other nations do similar, except they did not pass these tricks by their parliament or in a publicised law.
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
It's good to see more governments acting to grant themselves the ability to overtly subvert PKI on a global basis while Google is busy removing the only technology standing any chance of offering end users a clue.
I'm sorry to break it to you, but your IQ was 50 before the name change too, as evidenced by the fact that you changed your name to Hognoxious Turkeydance Mightymartian.
-=This sig has nothing to do with my comment. Move along now=-
Centralized trust leads to the center of trust being co-opted by those who wish to centralize power. In so doing they break the trust. When they become untrustworthy the people try to organize using the tools they were told lead to equitable government at which point the armed police are sent in to restore law and order. Other governments condemn violence on 'both sides', those being hit and those doing the hitting, but implicitly condoning the action for fear of their own people getting the wrong message.
The current system with the hierarchy where a single CA is the only one deemed trustworthy enough is broken since a long time. A new solution is necessary where cross-signing with multiple CAs on a single certificate is necessary to measure how trustworthy a certain certificate is.
Done correctly this would ensure that a single CA isn't able to hold the full key for signing either. This would of course require a completely different architecture in the trust structure.
In addition to this - the keys used to get authorized by a CA could be built redundant so even if one single CA expires your key the redundancy would keep it valid - this would lower the risk caused by CAs going bad, suffer an intrusion or going out of business - or just suffer a denial of service attack.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
I am willing to bet all my money that the US gov has long had the same capability - just not said publicly, and just used by only CIA/NSA and nobody else.
So this is how electronic government services are killed -- not by a fierceness of a DDOS attack, but by conflicting values and goals in the global Internet.
There are a number of proposals out there for alternatives that would supplant or replace CAs as the root of trust on the web. Storing keys in DNS via DNSSEC and DANE for one .EFF Sovereign Keys proposal. And I swear there are others but I cant find any right now.
Right now we are in a situation where any one of who knows how many CAs can produce a valid certificate for a web site without the web site even knowing it (and can do so for any number of reasons including a rogue employee, a government or government agency forcing them to do it or a hacker compromising the system and stealing the keys as happened to another Dutch CA, DigiNotar)
Why has there been no interest in supporting these alternatives that eliminate the possibility of CAs producing bogus certificates?
The real question should be, What is Chrome doing? Firefox's market share has dropped to the low single digits, making it essentially irrelevant. Chrome, on the other hand, is used by about 60% of web users. It's what Chrome does that really matters. If Chrome works with these certs but Firefox doesn't, then Firefox will appear to be broken as far as users are concerned. If Chrome blocks them, then Firefox will have no choice but to block them, too, otherwise it will appear to be insecure. Chrome determines how these certs should be handled, even for Firefox and the other browsers.
Nothing to see here, this is just islamization in action. We want absolute freedom for Muslims world wide to settle in Europe and absolute freedom to let them create their own sharia state within Europe, so everyone has to give up their privacy and security to prevent non Muslims from being islamophobe and Muslims from killing others. What better way to allow absolute freedom of religion by taking away some freedom of speech and freedom of non-islamic thought? We must do everything that is possible to prevent Europeans from choosing a Trump like leader who isn't afraid to offend those poor Muslims. We want an inclusive, diverse and multicultural Europe where you don't have to be afraid to be offended by the speech of someone else! At least that is what the 5th colon and their political pamperers want us to want. Now with total surveillance of what news we consume and what we type online, the multicultural, inclusive and diverse utopia can no longer fail!
This is why Dutch people should vote pirate party. The pirate party has been opposing these kind of regulations since it's inception, for good reasons. If they would get only one seat in the dutch house of parliament (tweede kamer) that would mean having the chance to be heard instead of years long silence in this digital age. Why would you let technology-scared people rule the future?
This is exactly right. If a browser trusts a signing authority, that authority can sign for any domain.
You don't need to split the key to do this, so this is actually not that hard. A simple matter of standardization... :)
A new solution is necessary where cross-signing with multiple CAs on a single certificate is necessary to measure how trustworthy a certain certificate is.
That sounds awfully like PGP's web of trust. Which, come to think of it, isn't a bad idea.
Ezekiel 23:20
Government is a criminal mafia enterprise masquerading as being in the public interest. You are forced to pay it for protection, when really it is government you most need protecting from.
> One of the issues I see is that there is a difference between trust and encryption, but the average user may not make the distinction.
There actually isn't much difference, in use cases TLS is normally used for. Or more specifically, you can't usefully have one without setting up the other. To have useful encryption you must identify the other party, and to trust their identity you must have, at minimum, cryptographic signatures of the your personal challenge key with server's key and the data (at which point enciphering the data comes almost for free).
Suppose you wish to have encryption, without trusted authentication of identity. You want the connection between your browser and your bank to be encrypted (not readable by anyone else), without ever ensuring that you're talking to the bank's server. You'll end up with an encrypted connection between you and the bad guy. You think your browser is talking to the bank's server, but it's really talking to the bad guy's server. Given that the whole point is to prevent the bad guy from reading exchange, setting up an encrypted connection to the bad guy is effectively the same as no encryption at all. The bad guy can read the data.
Suppose you want identity (confirm the message was actually sent to you from the bank). You must ensure that no man-in-middle has changed the message along the way, or the message you receive is no longer the message from the bank, but instead a message from hacker. The message must therefore include at least a cryptographic signature on the bank's public key and your challenge bytes (for replay prevention). While not exactly encryption per-se, that's 90% of the way to encryption.
So encryption and trust of identity are very closely linked. Useful encryption requires trusted identity. In special cases you can theoretically use null encryption to throw away the encryption and maintain only identity, but at that point you already have everything you need for encryption and you haven't made anything easier.
Brave is going to take a big chunk out of both Chrome and Firefox once it exits desktop beta.
https://www.icann.org/news/blog/documentation-is-key-to-recovering-hijacked-domain-names
Asking whether to trust CAs or domain registrars to guarantee that you are connecting to the site you think you are, is like asking whether to trust Hillary or Donald on their promises to help the middle class (as defined outside Manhattan).
This is only tangentially related, but it needs to be reposted at least once a year.
BlackHat USA 2011: SSL And The Future Of Authenticity — Moxie Marlinspike
Hilarious Comodo story begins around 5 m mark.
Slide at 10:48 has only become funnier in the meantime.
Sorry, have to post this as AC. I can assure you that all governments (including the one in *your* country, whatever your country may be) actively do the same thing all the time. Every one of the big cert issuers is fully cooperating with their respective government. Dutch are being somewhat naively honest here.
The Internet does not need this country. Block them from access.
What we need is someone to make a nice project that does deep packet inspection looking for TLS packets and alerts any certificate is found that leads back to a list of dodgy CAs. In the case of the Dutch government they only sign government sites so you should very rarely encounter a certificate signed by them. The alerting of course should not use services outside of your own network.
This project could be expanded by building a database of certificate signatures to all your commonly used sites. If the chain should suddenly change, you could also be alerted. But if firefox don't remove the CA start with the simple case and just alert wheneven the Dutch government CA is being used to certify a connection. Could also make it automatically kill the connection if found.
One problem with the Dutch increasing their surveillance on the citizens is that they are not simultaneously increasing the government's own accountability. The Dutch government is notoriously unaccountable for their actions for a country presents itself as civilised. Even for very unimportant things and at local level if they government is involved in shady practises they have numerous mechanisms for screwing the civilian by being unaccountable for their actions. The government has written into law that they do not have to handle a complaint about anything if the incident occurred more than a year ago, which is almost all the time. The onbudsman is anything but impartial and has no interest at all in investigating any complaints, particularly the sort of complaints that need really need dealing with, and they also have a rule that you can't switch them in unless you have already complained directly to the part of the government that may be screwing you. And the freedom of information act is regularly countered even out of trivial objections from the government. In short, it's shocking just how ineffective Dutch citizens in calling in government accountability. Most Dutch people don't realise how lacking in integrity their government can be until they actually come to test it.
The Dutch people should group together and start another referendum to change the law to try and improve the accountability of the Dutch government to go hand in hand with the increase of surveillance on their own citizens.
If they remove the dutch CA, then they should also remove every american CA as they have the same duty to obey to create certificates if an US government agency asks them to (and in most cases aren't even able to talk about it).. So blocking the dutch CA is only a very hypocritical move if they don't do it with other CA's.
But you're still Anonymous Coward to your friends, right?
You're one desperately sad fucker.
I do not want your cheap brainburning drugs. They are useless for work. And I am a working man today.
because: http://gs.statcounter.com/brow...
We'll make great pets
Thank god the Dutch have no living experience with a mass-murdering dictatorship that would abuse such power to maintain its power, and the last time they did was so distantly remote in the past that they can so rest assured of it never happening again that they can hand over such power for prosaic crimes and never fear a loss of freedom again!
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.