An update on attempted man-in-the-middle attacks

Re:An update on attempted man-in-the-middle attacks by tptacek on Tuesday August 30, 2011 @01:45AM (#2940277)

IE is killing it too, and, as this post points out, so is Mozilla.

Sign a Google Mail certificate for Iran? Fuck you. You're done.

In the medium term, I think a lot of HN people should also take a hard look at CONVERGENCE.IO. For now, though, it's heartening to see the real power behind Internet trust (hint: it's not Verisign and it's not the IETF) taking this seriously.

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by pilif on Tuesday August 30, 2011 @03:19AM (#2940457)

IMHO, just blacklisting these resellers is worthless as there is obviously not enough oversight over who can be a reselling CA.

This is the third time this year that a Comodo reseller has been breached. Comodo should scrutinize their customers better or THEY should get blacklisted (taking all their other resellers with them) at least until they made sure that their clients have all resolved their security issues

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by lawnchair_larry on Tuesday August 30, 2011 @07:57AM (#2941036)

This is not a Comodo reseller. This is a root CA. Your browser has its own entry for DigiNotar in it.

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by stanleydrew on Tuesday August 30, 2011 @02:32AM (#2940370)

It's heartening but it's also not. Surely there have been many other cases of invalid certs being granted for lower profile sites, perhaps by this very same CA, without any of us ever hearing about it. And surely the granter of one of those is still considered valid within many browser/OS configurations. But because this was an invalid Google cert the CA gets shut down.

It kind of highlights the difficult problem of when to decide to blacklist a CA in the current model.

And for clarity, who/what do you think is the real power behind Internet trust? I've been thinking about it for five minutes and can't come up with a good answer.

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by thurn on Tuesday August 30, 2011 @02:39AM (#2940387)

Browser vendors, perhaps?

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by wisty on Tuesday August 30, 2011 @05:09AM (#2940658)

And OS vendors. And whoever configures the computer. You buy a computer that was made in China, and it has root certs already in there (thanks to either Microsoft or Apple, or the shop who sold it, or the guys who assembled it - who knows?). Chome / Safari uses the system certs. All good, right?

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by rhizome on Tuesday August 30, 2011 @04:42AM (#2940610)

who/what do you think is the real power behind Internet trust

Nobody, it's all fiat. Verisign started this scam and we're just seeing the follow-on effects. There has never been anything more than the words and policies supporting the CA industry.

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by dschobel on Tuesday August 30, 2011 @02:31AM (#2940367)

Was the CA definitely complicit in this attack? I always assume that private companies have little recourse at state scales of force.

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by jbri on Tuesday August 30, 2011 @02:43AM (#2940402)

Either the CA was complicit, or they weren't secure. Regardless of which it is, the CA's root certificate is not trustworthy.

If they were hacked into, spoofed into giving out a certificate, or raided by special forces and had data physically stolen from their servers, then perhaps they can generate a new key and have that become trusted once they've taken steps to ensure something like this doesn't happen again.

But there's no way anyone can trust their old root key anymore.

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by tlrobinson on Tuesday August 30, 2011 @02:39AM (#2940383)

Does it matter whether they were complicit or simply compromised? Either way they shouldn't be trusted.

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by darklajid on Tuesday August 30, 2011 @06:52AM (#2940876)

I wanted to give convergence.io a try, but - they offer a Firefox addon that doesn't install for FF 6.

Nice website, no idea if it works. Sounds cool, but more Beta than a Google Beta I guess.

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by mike-cardwell on Tuesday August 30, 2011 @07:37AM (#2940976)

I tried convergence.io, but it's incompatible with Certificate Patrol. Certificate Patrol is an addon which alerts you to certificate changes.

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by mibbit on Tuesday August 30, 2011 @04:42AM (#2940609)

Has IE switched to auto updating or anything?

I love the fact that Google can push changes out to Chrome users immediately. That's a massive win for everyone.

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by 1amzave on Tuesday August 30, 2011 @04:50AM (#2940623)

Really? If Chrome's had updates pushed to it recently, how do I know that my browser itself, as installed on my filesystem, isn't now innately subverted by the Iranian government? (Note the domain in question in this particular case.)

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by dchest on Tuesday August 30, 2011 @05:21AM (#2940677)

I don't know about Chrome's update process, but they can simply have their own verification without root certificates (i.e. just like what most Mac software with Sparkle updater do: keep a public key inside the app, and verify the signature of updates).

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by mibbit on Tuesday August 30, 2011 @07:30AM (#2940951)

The auto-update process should be far more secure than SSL certificates. They'll have keys in the current Chrome which it'll use to check any updates are legitimate before they get unpacked/installed.

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by waitwhat on Tuesday August 30, 2011 @12:09PM (#2942038)

They do do this? Or they could do this?

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by sjs382 on Tuesday August 30, 2011 @11:14AM (#2941783)

Is convergence.io available for Chrome?

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by quadhome on Tuesday August 30, 2011 @03:02AM (#2940430)

I hope, so much, that Convergence.io the future.

But, you said "medium term." What's the long term?

[ Parent | on HN ]