Re:Wikipedia’s Switch to HTTPS Has Successfully Fought Gover...
by schoen on Tuesday May 30, 2017 @12:20AM
(#14442988)
I think this distinction is a good one, and I'll try to be more attentive to it when writing about this in the future.
Hopefully the risk for the attacker from the two kinds of attack are gradually converging, due to pinning and especially Certificate Transparency.
Re:Wikipedia’s Switch to HTTPS Has Successfully Fought Gover...
by manquer on Tuesday May 30, 2017 @12:42AM
(#14443039)
revoking the root outside china will have no bearing within. All devices sold and used in china could be forced to include that root. There is not a lot a user could do , especially in mobile if you have locked phone and only access to the official app store
Re:Wikipedia’s Switch to HTTPS Has Successfully Fought Gover...
by kijin on Tuesday May 30, 2017 @12:57AM
(#14443069)
There's a fine line between cartoon-villain evil, exemplified by people like Kim Jong Un who just doesn't seem to give a fuck, and just-enough-to-achieve-your-objectives-but-not-enough-to-make-too-many-people-notice evil, which is what China is aiming at.
Lots of people travel in and out of China with all sorts of computing devices. China does care about the reputation of their root and of their highly profitable electronic exports.
What's more dangerous, and much more likely, is that they might use forged certificates against specific individuals for a short period of time, for example, to intercept login credentials. The attack will go unnoticed as long as they also block the corresponding HPKP reporting URL (if the targeted site uses HPKP at all).