An update on attempted man-in-the-middle attacks

Re:An update on attempted man-in-the-middle attacks by idlewords on Tuesday August 30, 2011 @02:41AM (#2940393)

Anyone know a way to remove DigiNotar as a system root CA in OS X? I spent a few minutes struggling with Keychain to no avail, and couldn't Google my way to useful help.

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by AdamGibbins on Tuesday August 30, 2011 @04:05AM (#2940539)

Click "System Roots" on the left, find the CA. Right click then "Get Info". Expand the "Trust" section at the top and select "Never Trust".

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by gurkendoktor on Tuesday August 30, 2011 @04:59AM (#2940641)

I have un-trusted the Chinese CNNIC two operating system versions ago (10.5), and it is still set to the same setting. This seems less fragile than deleting the cert to me.

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by thyrsus on Tuesday August 30, 2011 @09:38AM (#2941358)

Thanks! If I were IT support, how could I get this to happen on every Mac in the company?

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by biafra on Tuesday August 30, 2011 @02:52AM (#2940415)

I am also unable to delete it. Which is strange since there is an option to delete it.

If you cannot delete it, you can edit the trust settings to never trust it.

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by dekz on Tuesday August 30, 2011 @02:51AM (#2940413)

Keychain -> System Roots -> Search for DigiNotar -> Right click delete.

Assert it has been removed by navigating to https://www.diginotar.nl/

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by dredmorbius on Tuesday August 30, 2011 @04:04AM (#2940535)

Is that what you really want to do?

What's to keep an OS upgrade from restoring the certificate?

A system or user-maintained blacklist seems like a more tenable solution. You don't want to delete the cert, you want to hang a scarlet letter on it. Oh, and not trust it for anything (or better, use it to blacklist any site that attempts to use it).

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by eonwe on Tuesday August 30, 2011 @12:55PM (#2942213)

At least for me there's no such choice as delete in the System Roots keychain. The only thing I can do is to set it to "never trust" and still Chrome/Safari show it as trusted: http://imgur.com/NcUYf

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by biafra on Tuesday August 30, 2011 @02:54AM (#2940420)

Did you try that and it really removed the CA?

Or is it supposed to remove the trust only but keep the entry?

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by dekz on Tuesday August 30, 2011 @03:08AM (#2940438)

It removed the entry completely from the Keychain, I am on Lion for reference.

Sanity testing by loading the homepage over HTTPS results in a certificate warning on all browsers (Firefox redirected to HTTP).

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by idlewords on Tuesday August 30, 2011 @04:38AM (#2940602)

Right-click delete is not an option on Snow Leopard, for some reason.

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by sid0 on Tuesday August 30, 2011 @04:20AM (#2940567)

Firefox uses its own CA store, so you need to remove it there too (or wait for the 6.0.1 update).

[ Parent | on HN ]