News for hackers. Stuff that matters.

A comment on Microsoft silently adds Amazon root certificates to its CTL. Parent comment

Re:Microsoft silently adds Amazon root certificates to its CTL by withjive on Friday January 22, 2016 @10:43AM (#10953332)
That analogy is actually pretty weak.

When you buy Chevy Bolt, your not expecting to use TLS to securely lock your doors.

However, if ACM is compromised by a "spy agency" — then anything you intended to be protected by a secure HTTPS transport is now logged, and easily decrypt-able by the "spy agency" at their convenience.

[ Parent | on HN ]
Re:Microsoft silently adds Amazon root certificates to its CTL by strommen on Friday January 22, 2016 @10:49AM (#10953367)
When you buy a Chevy Bolt, you may not realize that a) the government knows everywhere you drive, and b) law enforcement can remotely disable your car via OnStar.
[ Parent | on HN ]
Re:Microsoft silently adds Amazon root certificates to its CTL by marshray on Friday January 22, 2016 @09:46PM (#10956954)
Not only that, they can listen to your in-car conversations: http://www.zdnet.com/article/fbi-taps-cell-phone-mic-as-eave...
[ Parent | on HN ]
Re:Microsoft silently adds Amazon root certificates to its CTL by withjive on Friday January 22, 2016 @10:55AM (#10953403)
Not a problem unless your a criminal.
[ Parent | on HN ]
Re:Microsoft silently adds Amazon root certificates to its CTL by iolothebard on Friday January 22, 2016 @11:29AM (#10953670)
With foresight like this, who needs to worry?
[ Parent | on HN ]
Re:Microsoft silently adds Amazon root certificates to its CTL by gnu8 on Friday January 22, 2016 @06:01PM (#10956137)
Chelsea Manning is a criminal.
[ Parent | on HN ]
Re:Microsoft silently adds Amazon root certificates to its CTL by Spooky23 on Friday January 22, 2016 @11:23AM (#10953625)
Why is the key to my car less important than the key to my website?

It's highly likely that my car has a lot of where I go, what I listen to, how long I idle, etc.

If you're really worried about spy agencies tracking you, your car is a much riper target. LPRs are everywhere.

[ Parent | on HN ]
Re:Microsoft silently adds Amazon root certificates to its CTL by acdha on Friday January 22, 2016 @11:26AM (#10953651)
In what scenario is ACM compromised but the spy agency cannot compel Amazon to grant access to any other service?

Changing which private key your ELB used doesn't change the fact that you were already trusting Amazon to operate it.

[ Parent | on HN ]
Re:Microsoft silently adds Amazon root certificates to its CTL by tracker1 on Friday January 22, 2016 @12:01PM (#10953915)
But with OnStar services, they can unlock your car without your knowledge to do who knows what, and track your vehicle's movements without your knowledge... so, it's not THAT much of a difference.
[ Parent | on HN ]