Web Browsers Drop Mysterious Company With Ties To US Military Contractor (washingtonpost.com) 57
An anonymous reader quotes a report from the Washington Post: Major web browsers moved Wednesday to stop using a mysterious software company that certified websites were secure, three weeks after The Washington Post reported its connections to a U.S. military contractor. Mozilla's Firefox and Microsoft's Edge said they would stop trusting new certificates from TrustCor Systems that vouched for the legitimacy of sites reached by their users, capping weeks of online arguments among their technology experts, outside researchers and TrustCor, which said it had no ongoing ties of concern. Other tech companies are expected to follow suit.
The Post reported on Nov. 8 that TrustCor's Panamanian registration records showed the same slate of officers, agents and partners as a spyware-maker identified this year as an affiliate of Arizona-based Packet Forensics, which has sold communication interception services to U.S. government agencies for more than a decade. One of those contracts listed the "place of performance" as Fort Meade, Md., the home of the National Security Agency and the Pentagon's Cyber Command. The case has put a new spotlight on the obscure systems of trust and checks that allow people to rely on the internet for most purposes. Browsers typically have more than a hundred authorities approved by default, including government-owned ones and small companies, to seamlessly attest that secure websites are what they purport to be."Certificate Authorities have highly trusted roles in the internet ecosystem and it is unacceptable for a CA to be closely tied, through ownership and operation, to a company engaged in the distribution of malware," Mozilla's Kathleen Wilson wrote to a mailing list for browser security experts. "Trustcor's responses via their Vice President of CA operations further substantiates the factual basis for Mozilla's concerns."
The Post reported on Nov. 8 that TrustCor's Panamanian registration records showed the same slate of officers, agents and partners as a spyware-maker identified this year as an affiliate of Arizona-based Packet Forensics, which has sold communication interception services to U.S. government agencies for more than a decade. One of those contracts listed the "place of performance" as Fort Meade, Md., the home of the National Security Agency and the Pentagon's Cyber Command. The case has put a new spotlight on the obscure systems of trust and checks that allow people to rely on the internet for most purposes. Browsers typically have more than a hundred authorities approved by default, including government-owned ones and small companies, to seamlessly attest that secure websites are what they purport to be."Certificate Authorities have highly trusted roles in the internet ecosystem and it is unacceptable for a CA to be closely tied, through ownership and operation, to a company engaged in the distribution of malware," Mozilla's Kathleen Wilson wrote to a mailing list for browser security experts. "Trustcor's responses via their Vice President of CA operations further substantiates the factual basis for Mozilla's concerns."
I am groot! (Score:1)
Re: I am groot! (Score:1, Offtopic)
Re: (Score:3)
I think the problem with using DNS for this is that you could just MITM the DNS as well, unless you're using DNSSEC, which uses... certificate authorities. One would think you could have a more restricted list of CAs for DNSSEC, but a lot of libraries don'
Re: (Score:2)
In what way does DNSSEC use certificate authorities?
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Re: (Score:1)
I'm sorry go daddy but..... (Score:1)
Everyone does not like porn (certs)
NSA, Super Genius (Score:3)
- NSA
They did NOT "certify websites were secure" (Score:5, Insightful)
They didn't certify the websites were secure; they certified that the websites were who they said they were.
The problem is that they (like other CAs) can certify that anyone is who they say they are, and their relationships make them suspected of doing it in situations where they shouldn't.
Pretty weird that after so many years, we still fully trust single CAs instead of requiring a consensus from several of them. The way we currently do this, has virtually no chance of ever becoming particularly trustworthy.
Re:They did NOT "certify websites were secure" (Score:5, Interesting)
Pretty weird that after so many years, we still fully trust single CAs instead of requiring a consensus from several of them. The way we currently do this, has virtually no chance of ever becoming particularly trustworthy.
This is not at all weird after the Snowden releases. The simple fact is that we are now clear that the security agencies in the five eyes deliberately sacrificed civilian security for their own convenience in spying on people. Specifically that they acted to block the success of both things like PGP and things like IPSEC for years. Think that, if PGP had been a full success then the web of trust that it had built, with no single points of failure could be extended to cover things like web site certificates.
North Korea has been using cryptocurrencies to get money from ransomware to finance it's Military development in ways that likely would have been impossible if security had been done properly. Microsoft also gets a large share of the blame here, but not nearly everything.
Re:They did NOT "certify websites were secure" (Score:5, Informative)
Modded as a troll; I wonder why? Let me link to specific evidence of the NSA sacrificing everyone's security for their own ease of hacking [schneier.com], just in case someone is trying to imply that I'm being less than honest.
Our security service have a job to do and that is making us secure. The US ones may have done a good job in Warning of Ukraine, but before that they allowed Russia to trample all over the West.
Re:They did NOT "certify websites were secure" (Score:5, Informative)
Better yet, domain owners should implement DANE records stating exactly which CA should be issuing certificates for which portions of their domain namespace. That alone won't prevent rogue CAs from signing certificates for domains that don't use DANE, but it'll stop any CA except the correct one from issuing certificates for a DANE-secured domain. If implemented per the spec on the browser side (which all the implementations I know of do) it even removes the need for a known CA root and allows a domain owner to specify their own self-signed certificate as the only valid root for certificates for their domain. Combined with DNSSEC it makes things about as secure as they can be.
Re:They did NOT "certify websites were secure" (Score:5, Informative)
Web browsers have to implement DANE first before website owners have any incentive to implement it. Web browsers do NOT currently implement DANE:
https://caniuse.com/dnssec [caniuse.com]
Here's the relevant Bugzilla issue for Firefox that is now 12 years old and still unimplemented:
https://bugzilla.mozilla.org/s... [mozilla.org]
And here's an interesting article on why DANE hasn't been widely implemented:
https://blog.apnic.net/2021/08... [apnic.net]
However, if the main complaint is performance, well performance problems are generally solvable whereas having root CAs stores in web browsers is NOT a solvable problem (OCSP, CRLs, etc). DANE is a step in the right direction but the browser vendors have actively buried their heads in the sand over it, which brings about nutty conspiracy theories like: "Mozilla being handed FISA court orders to not implement DANE so that the NSA can keep their backdoors in place. NSA's probably fine with any given CA cert going away since all they have to do is compromise the Let's Encrypt CA with a FISA court order...assuming they haven't done so already. Let's Encrypt is already super suspicious too as Mozilla would rather spend $1 million USD/year for the Let's Encrypt CA instead of implementing DANE."
Then stories like this one come up, which prove beyond a shadow of any doubt that NSA has its grubby little fingers all over the basic bits of cryptographic communications over the Internet: CA root certs in certificate stores. Huh. Maybe the conspiracy theorists had it right all along! I personally always thought it strange that when Netscape first created SSL there were export variants of the browser so that NSA could easily decrypt those communications...and then one day, the export variants inexplicably vanished and there was just one version that everyone used.
Re:They did NOT "certify websites were secure" (Score:5, Informative)
Pretty weird that after so many years, we still fully trust single CAs instead of requiring a consensus from several of them.
You can setup Certificate Authority Authorization in your dns to do just that.
Add a "CAA" record for your webservers domain with "issue your.chosen.ca.here"
You can add multiple records too when planning to switch CAs.
A browser receiving a cert signed by any other CA will fail SSL validation.
Chrome, Firefox, and Safari all check these. I only assume Edge does too but never actually checked that.
It's only been part of the TLS standard since 2010 so depending on the client application, it's possible it goes out of its way to not check this validation step. Most TLS libraries do check by default however.
Re:They did NOT "certify websites were secure" (Score:4, Insightful)
You can setup Certificate Authority Authorization in your dns to do just that.
Add a "CAA" record for your webservers domain with "issue your.chosen.ca.here"
You can add multiple records too when planning to switch CAs.
For the life of me I don't understand the merit of these schemes. It doesn't prevent a rouge CAs from issuing certs, it doesn't prevent DNS from being spoofed. If DNS were secure CAs would be redundant.
Can anyone describe a real world use case of CAA where it would be helpful? If someone were able to spoof your website but not DNS and your CA knew you and wouldn't allow anyone else to attempt automated procedure to procure a cert then I guess then and only then would this be useful. Seems rather unrealistic to me.
A browser receiving a cert signed by any other CA will fail SSL validation.
It explicitly will do no such thing. CAA is exclusively for CAs.
Chrome, Firefox, and Safari all check these.
They do nothing of the sort.
It's only been part of the TLS standard since 2010 so depending on the client application, it's possible it goes out of its way to not check this validation step. Most TLS libraries do check by default however.
Again completely, totally 100% incorrect. The CAA RFC is explicit about this:
"A set of CAA records describes only current grants of authority to issue certificates for the corresponding DNS domain. Since a certificate is typically valid for at least a year, it is possible that a certificate that is not conformant with the CAA records currently published was conformant with the CAA records published at the time that the certificate was issued.
Relying Applications MUST NOT use CAA records as part of certificate validation."
Re: (Score:2)
DNS over HTTPS offers secure DNS.
None of these technologies are silver bullets, but together they all make it harder to spoof websites.
Re: (Score:2)
DNS over HTTPS offers secure DNS.
No it doesn't.
All the DNS over TLS schemes do is protect the session between name server and client. They don't protect underlying infrastructure. Even if a CA used DNS over TLS this would make ZERO difference. Root query would return the same insecure glue and referenced DNS server would transmit the same insecure responses. All subject to trivial MITM attacks.
None of these technologies are silver bullets, but together they all make it harder to spoof websites.
These so called technologies actively hinder deployment of the cheaper, easier and more secure option by leading people to believe all the half
Re: (Score:2)
Pretty weird that after so many years, we still fully trust single CAs instead of requiring a consensus from several of them. The way we currently do this, has virtually no chance of ever becoming particularly trustworthy.
I agree. I'm guilty of putting a bit too much faith in the little padlock symbol. For now I'm content to use Google search to "verify" the legitimacy of a domain. I just skip the "https://" prefix to initiate a Google search, then click the link when it shows up as the top search result.
Re: (Score:2)
We shouldn't use certificates for confirming identity at all. All major browsers have stopped doing it. The certificate is only useful in determining that the server is really authorized to serve that domain.
Consensus wouldn't really help. Anyone can get a cert from LetsEncrypt, and that's a good thing. If consensus was required we would just need two or three similar services, all with the same level of automated domain controller checks.
And yet Chinese CAs are accepted? (Score:5, Interesting)
Re: (Score:2, Flamebait)
Re: And yet Chinese CAs are accepted? (Score:5, Insightful)
China just roasted people alive in an apartment building because their COVID policies forcibly lock people in their homes. China deserves all the hate they get.
Re: (Score:2, Offtopic)
Re: And yet Chinese CAs are accepted? (Score:2)
Oh there's plenty of reason to be passed at the US lockdowns, but none of them went to the extent of burning people alive.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Further, medical excuses were granted in all of the above scenarios, that I heard of, but "I don't wanna!" isn't a "medical excuse." Again, draconian doesn't apply.
Re: (Score:2)
But this isn't about whether or not the vaccines were a good idea, it's about what to do with those who comply. And every single time I ask a generic lib the question I did above, they evade answering it Every. Single. Time. What will you do with those who don't take it? Try answering the question without falling into your routine.
You don't see it as draconican because you agree with it. You love the boot so long as the foot is yours. And thank the FSM that the vaccine mandates failed, because digital ID w
Re: And yet Chinese CAs are accepted? (Score:2)
That should read pissed.
Re: And yet Chinese CAs are accepted? (Score:2)
Re: (Score:2)
Re: (Score:3)
Is there any evidence at all that those Chinese CAs have abused their position?
Do you really want to go down the road of "we don't trust this entire country and everyone who lives there, so we should delete all their CAs?" If you do, I'll have to point out that US based CAs are vulnerable to things like National Security Letters, if they aren't voluntarily helping the government already. Should Mozilla just remove CAs from any country that has laws allowing it to interfere with them? Or just trust nobody at
Re: (Score:1)
Re: And yet Chinese CAs are accepted? (Score:2)
In the end this is true for every country, though. In China the government will get the information straight away; in countries with rule of law the information is one mandate away (or they can get it through a law, as well).
Re: (Score:2)
I hate to break it to you but CAs in many countries are required to cooperate with the government. That's the case in both the US and most of Europe. If government cooperation is your red line, then most CAs need to be deleted.
My advice is to stop trying to use CAs to identify the operator of a site. Most browsers already have.
Re: (Score:2)
I'll have to point out that US based CAs are vulnerable to things like National Security Letters
STOP TROLLING.
I have pointed this out to you before, so I am sure you damn well know that you are lying.
A national security letter does not give the government the authority to force a company to do anything other than hand over information they possess and not tell anyone about it. Nothing else. It is not a writ to compel action. It is a demand for information.
Re: (Score:2)
Hand over information like their private keys that they use to sign domain certificates?
Re: (Score:2)
Touche!
Well said, but no.... It does not work like that. NSLs are restricted to third party or custodial records held by the subpoenaed party -aka information you have about someone else, or information you have belonging to someone else.
Re: And yet Chinese CAs are accepted? (Score:1)
Screw your racisms. We are getting destroyed by our politicians, and our own ignorant people that prefer to see someone unnecessarily die of a treatable cause because "I ain't paying for someone elses healthcare", Now feel free to lable this as "off-topic" and down vote.
Re: (Score:2)
It is not about China. Users in China need to trust the chinese CAs in order to access important resources. If you want to access the website of a Chinese company, your browser needs to trust the CA that signs their certificate.
There are a lot of CAs included by default with my computers OS and browsers that I do not know anything about. Some of them, I definitely should not trust. Others I just don't have a clue who they are. And yet we trust them by default. If I disable some what will stop working?
Hurry (Score:1, Troll)
Innovation vs fuckery (Score:2)
I find it amazing the one and only feature intended to prevent these kinds of abuses was intentionally removed by Google.
Browser vendors universally refuse to implement any PAKE authenticated TLS schemes for secure password authenticated access to websites. (No certs required) even though they have been readily available for over a decade.
Anything that can provide useful "trust off-ramps" or improve security is systematically ignored or actively rolled back. Instead we get ridiculous non-measures like CT a
That's the problem with CAs (Score:4, Interesting)
Re: (Score:2)
The problem with the web of trust model is that it's too difficult for most users to use. They just want the browser to tell them if they are on their real bank's page or not, and many don't even look at the domain name in the URL, despite all major browsers highlighting it for them.
If you automate the process, it becomes vulnerable to people creating fake webs of trust. It's not difficult, particularly for state level actor, to create some fake organizations to sign their certs.
All major browsers have aban
Re: (Score:2)
Re: (Score:2)
I don't think any modern browser ranks certificates any more, there are no ratings presented to the user.
A quick comparison of slashdot.org and my bank's website shows that they are presented exactly the same way in Chrome.
After they got found out ;) (Score:2)
Why wont browsers adopt alternatives? (Score:2)
There are various things out there that aim to either totally replace or at least provide better security for the CA certificate system (DANE being one example).
Why aren't browsers willing to implement any of these systems?
Technical issues? (IIRC some ISP name servers or ISP provided router equipment may not able to properly handle DNSSEC)
Pressure from those who make, sell and use TLS proxy servers? (a lot of schools and workplaces and other entities need to use software that does MITM snooping on TLS traff