China Telecom diverted internet traffic in U.S. and Canada, report finds

Re:China Telecom diverted internet traffic in U.S. and Canad... by tialaramex on Wednesday October 31, 2018 @11:17AM (#18346381)

Certificates in the Web PKI ("SSL Certificates") are logged to the Certificate Transparency system.

Clients can choose to insist upon seeing proof that the certificates they're shown were logged (SCTs), Google's Chrome browser does this today.

Name owners can choose to check which certificates were logged for their names, either by operating their own log monitor or by having somebody else do it for them (Facebook will do this for free, but you're welcome to pay somebody if you don't like Facebook, or as I said, you can do it all yourself since the logs are public).

In practice even though the existing system is far from perfect we see relatively few problems, and fewer still actual attacks rather than screw-ups.

[ Parent | on HN ]

Re:China Telecom diverted internet traffic in U.S. and Canad... by throwaway2048 on Wednesday October 31, 2018 @12:17PM (#18346992)

certificate transparency only does anything for participating CAs, there are dozens/hundreds of CAs that do not participate in certificate transparency, including several either controlled by the Chinese government, or at less than arms length from its influence.

They can freely sign anything that isn't either certificate pinned, or has a CAA record. And both those things are client dependent, pretty much any ssl client besides chrome or firefox will not have the capability to do either.

[ Parent | on HN ]