Microsoft silently adds Amazon root certificates to its CTL

Re:Microsoft silently adds Amazon root certificates to its CTL by sebcat on Friday January 22, 2016 @06:37AM (#10952142)

Dan Kaminsky had a good talk[1] regarding this on 26c3, where he essentially argued that the only reason we have TLS at all is because companies selling stuff over the Internet wants to make it seem secure for the customer. State actors or large companies interested in data mining are not that interested in committing credit card fraud, so every one just accepts the PKI status quo more or less.

Or that was what I took away from what he said. I havn't seen the complete talk since he held it.

[1] https://events.ccc.de/congress/2009/Fahrplan/events/3658.en....

[ Parent | on HN ]

Re:Microsoft silently adds Amazon root certificates to its CTL by marshray on Friday January 22, 2016 @09:49PM (#10956963)

That may have been true with the original SSL, but consider all the B2B APIs, VPNs, and other critical stuff happening over TLS these days.

[ Parent | on HN ]

Re:Microsoft silently adds Amazon root certificates to its CTL by sebcat on Saturday January 23, 2016 @01:10AM (#10957401)

The problem is the PKI. For your own services, you can have your own PKI, and the issue of "trust one, trust all" is not really an issue anymore because you would only trust your own certificates for your own services.

The problem is that pretty much any CA trusted by your OS/browser can issue certificates that allows anyone who can control your network to MITM you.

A solution for this would be DNSSEC, where only .com would be able to sign foo.com, bar.com and other .com domains. But still, would you trust the issuer of .com certificates?

[ Parent | on HN ]