Google pulling China CNNIC CA from its products

http://googleonlinesecurity.blogspot.com/2015/03/maintaining-digital-certificate-security.html?m=1

by tptacek • 11 years ago

472 158 11 years ago

googleonlinesecurity.blogspot.com

tptacek• 11 years ago

It's a short update, but I can make it shorter:

After a short, limited grace period, Google won't honor the recently compromised Chinese CNNIC CA cert anymore, and won't reconsider until they implement Certificate Transparency.

ArchD• 11 years ago

What does this mean: "...nor do we believe the misissued certificates were used outside the limited scope of MCS Holdings’ test network,..."

If the certificates were used only in a test (private?) network, how did Google find out?

MichaelGG2• 11 years ago

I believe Chrome will report back when it finds an improperly issued certificate.

ryan-c• 11 years ago

https://scotthelme.co.uk/hpkp-http-public-key-pinning/

Chrome also preloads HPKP information for many sites.

It's interesting to note that certificates signed by a locally installed CA (e.g. an org's MitM proxy CA) will be considered acceptable. If MCS had just made their own private root CA and deployed it to their machines there wouldn't have been an issue.

est3• 11 years ago

what about wosign?

gruez• 11 years ago

not affected as it doesn't use CNNIC as root

cynix• 11 years ago

I've distrusted the CNNIC roots in my browsers but left WoSign alone for now. Is there any indication that they should also be distrusted?

blacktulip2• 11 years ago

When there is a indication, it would be too late.

Panino• 11 years ago

Can't think of a better response than this.

I'm only mildly supportive of Certificate Transparency, but would definitely like it to "have its day in court." Hopefully CNNIC deploys CT and reapplies to Google for inclusion, but either way it will be interesting. I love it when things get put to the test.

dmix• 11 years ago

Hopefully CNNIC deploys CT

What are the odds they'll do this? I'd bet extremely high.

haosdent2• 11 years ago

CNNIC is a joke, don't put any hope to them please.

MichaelGG2• 11 years ago

From the original part: "MCS Holdings on the basis that MCS would only issue certificates for domains that they had registered"

I don't understand why this would be allowed. Like, doesn't this break the entire concept of a CA if the CA will allow third parties to issue certs? I understand the need for corp MITM but that's best done by pushing out your own CA. And I understand the desire for a company to have its own self-managed CA system that's publicly trusted. But that simply cannot require the CA to put any trust into the other company; there's gotta be technical measures. That's why I'm confused as to why it matters if an HSM was used or not. Can someone enlighten me on what's going on?

anfedorov• 11 years ago

It's just an organizational decision. CNNIC is super trustworthy to a lot of people. It's so many people, in fact, that they can't possibly verify all of the sites these people want to visit. So instead of burdening CNNIC with verifying the identity of every single site that wants a cert that their users will trust, CNNIC will just verify some other CAs as being trustworthy enough to do the job.

Personally, I think I should trust the hardware or OS manufacturer to pick exactly who is trustworthy enough to certify websites, since I'm trusting them that my computer is doing what it looks like it's doing anyway.

click170• 11 years ago

I trust my OS to suggest sane defaults, but if I can't override them that's a bug IMO.

est3• 11 years ago

CNNIC is super trustworthy to a lot of people

No, CNNIC is not even trustworthy among Chinese Internet users.

CNNIC invented tons of rootkit adware and spyware. It has a very bad reputation. Google for 3721 中文网址 if you are interested

Although it claims to be a neutral non-profit organization, it does have multiple for-profit business lines.

In the past CNNIC belongs to China Academy of Science, but now it's just a puppet under ruling Party's control[1][2].

[1] http://en.wikipedia.org/wiki/Central_Leading_Group_for_Inter...

[2]: News in Chinese http://tech.gmw.cn/2014-12/27/content_14311910.htm

rtpg• 11 years ago

I think it's possible for the CA to delegate the authority to a specific subset of domains. But in this case MCS holdings apparently was given a certificate allowing them control over everything.

finnn• 11 years ago

I'm not 100% sure, but fairly certain the way that x.509 works, there is a boolean field for whether or not the certificate is an authority, with no control over what they are an authority for. I believe this field is called basic constraints.

JoshTriplett2• 11 years ago

The missing detail is that this "delegation" to an intentionally MITMing CA should never have been made in the first place. Using such a certificate in an HSM does not make that acceptable, and I don't have the impression that it would have been acceptable even in an HSM; I think that portion of the article was simply relaying the information CNNIC provided (in which they're trying to shift the blame onto MCS Holdings for further mishandling of an intermediate CA that should never have been issued in the first place).

The claim from CNNIC was that the intermediate CA would only be used for domains actually managed by MCS Holdings; however, there's no technical control in place to ensure that, even if you believe CNNIC didn't know exactly what the intermediate CA would be used for.

geofft8• 11 years ago

There was no intention to MITM here. MCS's goal was to become a certificate authority, and it's common practice for a new CA to get their CA cert signed by an existing one. Let's Encrypt is planning on doing exactly this, for instance.

What went horribly wrong is that nobody knew what they were doing, CNNIC didn't realize they had an obligation to bring in auditors to both CNNIC and MCS to make sure that people knew what they were doing, and MCS unintentionally placed the cert on a device that happens to do real-time SSL MITM.

I believe CNNIC's claim is about the "test" certificate that was issued to MCS. (The fact that they issued a test certificate off of a publicly-trusted one is another sign they didn't know what they were doing.)

There's a long thread on mozilla.dev.security.policy with replies by CNNIC and MCS that explains the story. (The CNNIC rep's English is pretty good, MCS's is good enough to get a sense of things.) https://groups.google.com/forum/#!topic/mozilla.dev.security...

sanxiyn• 11 years ago

This is the right move. It had to escalate compared to ANSSI case, because back then the claim was "this is the last time".

yuhong7• 11 years ago

Yea, they claimed that they were going to take years to comply with the BRs. They ended up limiting it to French TLDs. It seems that they are finally phasing out this CA now.

akandiah• 11 years ago

Wonder if Mozilla will follow suit: https://bugzilla.mozilla.org/show_bug.cgi?id=542689

bifurcation• 11 years ago

The Mozilla root program currently has a similar plan proposed, with a final decision pending in the next day or so.

https://groups.google.com/forum/#!topic/mozilla.dev.security...

MarkG509• 11 years ago

Thanks for the reminder to recheck my certs. I manually wiped CNNIC (among others) when the news first broke, and with today's Firefox update, I'll check again.

Laforet• 11 years ago

You can't just "wipe" a Root CA on Windows - you have to explicitly untrust it.

yuhong7• 11 years ago

Open certmgr.msc and put the certificate into the "Untrusted Certificates" store.

kijin6• 11 years ago

Good riddance.

We really need a "zero tolerance" system for CAs: As soon as you fuck up, you're out. There has been too much forgiveness and too little enforcement so far. Browser vendors, especially those with deep pockets such as Google, Apple, and Microsoft, should not be afraid to leverage their influence to make rogue CAs go out of business. Seriously, there are too many CAs already. 90% of them need to go bankrupt asap.

We also need some way to restrict what certificates "less trustworthy" CAs can sign. Even if CNNIC is one day reinstated, I wouldn't want them to sign any certificate for any domain that doesn't end with .cn. Ditto for various other government-sponsored CAs, which my browser also seems to trust for whatever reason. Even if TLS as we know it has no mechanism to enforce such restrictions, nothing stops browsers from doing it on their own.

korzun• 11 years ago

As soon as you fuck up, you're out.

You would have no CA's then. I love when people criticize others without offering a anything in return.

pooper2• 11 years ago

No, GP actually has a point. Once you do things like this, you're out. Once you're out, you become a nobody.

Of course, you can reapply to get in (haha, good luck getting a response from Mozilla before a couple of years) but you have to start from scratch all over again. This puts a tangible cost to shenanigans. I highly doubt Verisign would be caught making the mistake these guys did.

Dylan16807• 11 years ago

I think the proper number of CAs is a lot closer to zero than it is to the current hundreds.

kijin6• 11 years ago

Nah, we'd still have plenty of CAs at any given time. After all, it's highly unlikely that all of them will fuck up at the same time. If you buy from a reputable CA, there's at least 90% chance that you won't have any issues during the life of your certificate (1-2 years).

If the requirements for becoming (and remaining) a CA become stricter than they are now, the market will adjust after a while. Peace of mind has always been, and will always be, a very strong selling point. How about this: "We'll sell you three certificates for the price of one! One signed by Comodo, one signed by Verisign, and one signed by GlobalSign! And here's an Apache module that detects when one of your CAs get discredited, and automatically replaces it with a good one!"

geofft8• 11 years ago

You would have no CA's then.

Would you? We've seen, what, a dozen (at most) CAs do inappropriate things in the last several years? And there are hundreds of CAs? I think things would be fine.

In particular, there are lots of intermediates. My personal website's cert is from Gandi, which uses an intermediate chained off USERtrust. Gandi could arrange to have a second root CA sign their intermediate, so that if USERtrust gets kicked out, browsers can still construct valid chains. And I would gladly pay for such a feature from an intermediate, if the alternative were either my site being at risk of being marked untrusted, or SSL becoming meaningless.

darkarmani• 11 years ago

We also need some way to restrict what certificates "less trustworthy" CAs can sign. Even if CNNIC is one day reinstated, I wouldn't want them to sign any certificate for any domain that doesn't end with .cn. Ditto for various other government-sponsored CAs, which my browser also seems to trust for whatever reason. Even if TLS as we know it has no mechanism to enforce such restrictions, nothing stops browsers from doing it on their own.

Aren't you asking for "name constraints" to be enforced? If they could do this, they could fix the whole CA fiasco, but actually delegating domains rather than have a system where Root CAs are trusted for all domains.

kijin6• 11 years ago

Yes, "name constraints" is what I was suggesting. (I vaguely remembered that there was something in the relevant standards that allow such constraints, but I couldn't remember the name and wasn't sure that it was actually in the standards. So I just tried to explain the idea.)

steven2012• 11 years ago

Do you honestly believe that government organizations don't already have their own people in these CAs that are issuing certificates whenever they want?

kijin6• 11 years ago

Depends on which government we're talking about.

Until a couple of hours ago when I manually went through my browser's CA list, there were a lot of national and even subnational government agencies in there. Japan, Taiwan, South Korea, Catalonia, Valencia, and even Hong Kong Post has its own root CA.

yuhong7• 11 years ago

I was thinking of relaxing Mozilla's root inclusion requirements (I suggest to the same as Microsoft's) for government CAs in exchange for name constraints.

xorcist• 11 years ago

There are tons of edge cases here.

Let's assume, and this is not unlikely, that your favourite three-letter agency in is possession of a handful of trusted CA keys, acquired with extralegal methods.

What happens when there is leak? This may be the result of a whistleblower, or some mistake somewhere, which leads us to have a stronger confidence that these keys are out. Do we still blacklist? Only the intermediary, or all the way up to the CA?

I think we've seen from the past years that both root and intermediaries can follow every rule in the book and still get owned by intelligence agencies. We simply cannot pretend this is unacceptable for doing business.

exo762• 11 years ago

I think that this is a perfect case where tech giants can increase "cost of doing business" for NSA. NSA is having it too easyfucking over citizens. Now let them try fucking over businesses and still get away with it.

I think that this is a great reason to have zero-tolerance policy to CAs fuckups.

rakoo• 11 years ago

We bust the certs all the way to the CA. If it's been acquired through "extralegal" methods (an interesting word to not say "illegal", even though we all know it is), no matter who did it, security is compromised.

realityking2• 11 years ago

As soon as you fuck up, you're out.

That would create an even bigger incentive than today to cover any misuse up. Not sure that's what we want.

kijin6• 11 years ago

Heh, let the arms race begin!

When every browser ships with verified fingerprints for a lot of important websites, it will be nearly impossible to use fraudulent SSL certificates on any significant scale without triggering a worldwide alarm.

Chrome already reports home when it encounters a forged certificate for any Google property. Firefox has started to use Chrome's HSTS preload list too, and Microsoft said they would use it in IE & Spartan on Windows 10. The future isn't looking good for would-be certificate forgers.

eyeareque2• 11 years ago

This is what should happen when a CA does something insecure. Kick them out and make an example out of them. If you don't the whole system is worthless.

Ex: http://en.wikipedia.org/wiki/Comodo_Group#2011_breach_incide... Nothing happened after this breach, which was a shame.

EdwardDiego• 11 years ago

Hey mate, your "2011 breach incident" anchor points to nothing in the page. Am I missing something?

danuker• 11 years ago

It seems to be [here](http://en.wikipedia.org/wiki/Comodo_Group#Controversies) now.

eyeareque2• 11 years ago

[edit] Let's try this again: https://www.schneier.com/blog/archives/2011/03/comodo_group_...

The above link should work. This will teach me to link to an anchor on Wikipedia.

[original post] It should have been: https://en.wikipedia.org/wiki/Comodo_Group#Certificate_hacki...

scotty794• 11 years ago

If you don't the whole system is worthless.

The whole system is worthless and it should be replaced with something more like bitcoin. I don't really trust any certificate issuer more than I trust self issued certificate.

coderdude2• 11 years ago

it should be replaced with something more like bitcoin.

What does that even mean?

warbiscuit• 11 years ago

[Namecoin](https://namecoin.info/) is exactly that - in particular it's .bit domain is an attempt to be a blockchain-based decentralized DNS registrar. I'm not sure of the exact state of Namecoin with respect to DANES or other domain<->certificate binding protocols, but it looks like a pretty good start on the job.

Sanddancer• 11 years ago

Replacing with a blockchain is a horrible idea. If the certificate gets compromised, how do you handle revoking the old certificate? How do you handle someone having a domain name like paypa1.com? There are a lot of cases where having a human in the loop is a good thing for overall security. Now, this isn't to say that the current system isn't broken as hell, but a bitcoin type solution is definitely not the way to do it.

test1235• 11 years ago

For posterity:

http://i.imgur.com/8d7Uama.png

dheera2• 11 years ago

Unfortunately this won't make a big splash, unless MS takes action in solidarity with Google. MSIE and its variants are still the vast majority of the desktop browser market in China, by a huge margin.

ronnier• 11 years ago

MS is in bed with China. Google isn't. Microsoft is allowed to stay in China, Google was kicked out.

morgante• 11 years ago

MCS has a very sloppy response: http://www.mcsholding.com/MCSResponse.aspx

georgemcbay• 11 years ago

Sloppy on multiple levels.

The poor English doesn't inspire a lot of confidence in the company. I realize the company is from an area of the world that is not generally English-speaking, but geez, to respond to something as serious as this surely you can run your blog response by at least one native speaker to sanity check it before posting it.

But worse than that is the story they are seemingly trying to sell is that this is one random dude's fuckup -- which may very well be true, but that this could happen as the result of one random dude's fuckup speaks volumes about lack of much-needed process to deal with this sort of certificate responsibility.

jpatokal• 11 years ago

I do like the lines "the best of bread solutions" and "the sack of unintentional action" though.

rifung• 11 years ago

I think the main problem with giving it to someone else to sanity check is that if your own English isn't good, you'll have a hard time gauging someone else's English speaking skills.

I wouldn't be surprised if they did give it to someone who they thought spoke English well.

616c• 11 years ago

This is an Egyptian company. I had many expat friends when I lived there I will tell you beyond the most elite multinational corps no one sees the point.

You should see sandwich menus. I was saying, English correction per word, if people saw the value, would make me a successful small business owner in about 3 years. Haha.

geofft8• 11 years ago

These two PDFs got sent by CNNIC to mozilla.dev.security.policy by way of explanation:

https://pzb-public-files.s3-us-west-2.amazonaws.com/B2.pdf

The story is perfectly believable: MCS wanted to become a CA, the easiest CA that would chain them an intermediate was CNNIC, they generated the cert from a Palo Alto Networks device because it was the only convenient hardware/FIPS-compliant device they had lying around, and a technician accidentally plugged their laptop on the "MITM me plz" port of the Palo Alto box and fired up Chrome, which automatically sent some alarm bells.

Honestly that makes me more worried for the state of internet security than active malice. If any individual, organization, government, etc. were intending to MITM someone, we could (in theory) track them down and fire them, blacklist their root, or otherwise expel them from the internet community. But nobody had such an intention here. It's terrifying that a series of honest mistakes (extremely grievous mistakes, but honest ones nonetheless) could lead to a valid cert for Google and Twitter in the hands of someone who didn't even want them.

I think a very tiny bit of blame should impute to Palo Alto Networks here. How have they built a device where it's easy to start MITMing certificates by accident? I'm all for usable crypto UI, but this seems excessive. (And should it be built with safeguards that warn you loudly when the MITM intermediate chains to a publicly-valid CA, instead of an in-house one?)

Regarding why I think it's perfectly believable that CNNIC was the easiest CA that would chain them an intermediate: everyone that runs an actual intermediate program sells (as required by the Baseline Requirements) a hardware security module, or better yet, a web interface to a cert that remains in the physical possession of the parent CA. There's an arduous audit process and key ceremony required for the intermediate CA, almost as arduous as required of the root CA. CNNIC, meanwhile, had no intermediate program, and wrote in their Certification Practices Statement that they don't intend to issue such things. So MCS was able to talk them into doing something irresponsible and handing them a CSR and no further details.

AlyssaRowan• 11 years ago

No, I find that pretty damn hard to believe. Especially considering where it's coming from.

You don't accidentally do anything with an unconstrained CA key chained from the public root: that is a serious piece of data that can MITM anyone worldwide so at the very least should be under lock and key at all times! [It definitely shouldn't be plugged into any network: it should be locked in a Faraday-caged safe, on a dedicated hardware device, ideally under armed guard. You sign your operational CAs with that.]

CNNIC fundamentally broke their CPS: it has no intermediate programme, yet it intentionally misissued (at least!) one CA anyway. That is easily enough to get them pulled from everywhere, in line with current practice.

It's a pretty good demonstration of why we need something like CT, and (IMO) a public list of all intermediaries ever issued from any active CA.

codezero• 11 years ago

Does this mean Chrome on iOS will reject these certs? It's a bit unclear. I know they have to use the Safari rendering engine but I'm curious if there are any other internals at play here.

geofft8• 11 years ago

I believe iOS lets you specify your own validation callback. (For instance, I think best practice is for a random app on iOS, that only connects to its own servers for an API, to manually pin the public key and a backup public key for the server or at best a handful of CAs, instead of trusting the entire set of root CAs.) I don't know how extensively Chrome is using that feature.

pilif• 11 years ago

This is what I hoped would happen when we learned about the malicious intermediate: https://news.ycombinator.com/item?id=9254899

We need to send CAs a strong signal that the trust (and license to print money that comes along with it) we put into then hinges on them behaving properly. Making sure that their intermediaries do the same is obviously part of the deal.

We must make it very clear to CAs that hiding behind intermediaries is not an acceptable strategy to escape their responsibilities.

mrmondo3• 11 years ago

Glad to see this happening - I removed CNNIC from my machines back in Feb - https://github.com/sammcj/delete-unknown-root-ca

dredmorbius2• 11 years ago

Is there a readily accessible list of the CAs you're deleting? Ah, it's in the shell script itself, and there are just four of them. And this looks to be specific to Mac OS X only -- /System/Library/Keychains is not a frequently encountered path on, say, Windows, Linux, or BSD (non-Mac) boxen.

How does this work, e.g., on systems which install root CAs from standard packages? I think you'll find you'll need to 1) re-run the script and 2) that you're not getting the benefit of retaining the root but flagging it as untrusted.

I just posted on flagging the CNNIC root as untrusted in Debian. That's better than deleting the CA, as it should now show as negative trust if I'm grokkign things properly.

mrmondo3• 11 years ago

As the readme says: 'Also removes any user trust settings for each certificate'.

It's not intended as patch or fix for the CA system which is broken by design - merely something that I was interested in trying.

sorz• 11 years ago

If you want remove all China CAs, it may be helpful. https://github.com/chengr28/RevokeChinaCerts

mrmondo3• 11 years ago

Great link - thanks!

halayli3• 11 years ago

Why should we trust browser authors with their CA list (google, firefox, etc...)? PKI should be rethought because in its current form we are relying heavily on their trust. Sadly to the average user have no clue what's going on.

brohee7• 11 years ago

Read the root certificate inclusion policy of your vendors. In the end it comes down to how much you trust the vendor to implement the policy faithfully and whether you agree with the policy itself.

Google https://www.chromium.org/Home/chromium-security/root-ca-poli...

Microsoft http://social.technet.microsoft.com/wiki/contents/articles/3...

Apple http://www.apple.com/certificateauthority/ca_program.html

Mozilla https://www.mozilla.org/en-US/about/governance/policies/secu...

From a cursory look Ubuntu seems to mirror Mozilla cert store.

halayli3• 11 years ago

I understand. But the fact that I need to trust the vendor and the CAs is a broken concept.

revelation2• 11 years ago

Lovely words, of course in the case of Mozilla we already know its wholly worthless. Disregard whatever they write to the contrary.

Case in point: https://bugzilla.mozilla.org/show_bug.cgi?id=724929

realityking2• 11 years ago

We need someway to authenticate websites. The only viable alternative I know is DANE with DNSSEC. As long as DNSSEC is not widely deployed - and actually authenticated on the client - what alternative is there?

halayli3• 11 years ago

This is worse than not having an alternative because it gives a sense of security to people without knowing whom they are trusting.

tomjen3• 11 years ago

We really need to clean up the CAs. Hopefully once the lets encrypt guys gets to be operational we can nuke the rest, in a similar way to how Chrome is sunsetting the old encryption standards.

bsaul• 11 years ago

I just had an epiphany , when thinking about what role are those big companies playing now in our democracy, in the most general sense.

I think what google is doing there is a kind of "fact checking" ( this text on this page is really coming from this site), which means they're playing the role of a media counter power (in the sense of judiciary power, political power, and media). What's funny is that they don't need google news to play that role. Only a browser and a security policy is enough.

justaman• 11 years ago

Google is the single most important factor in modern democracy as information is power. Hence "Don't be evil."

teraflop• 11 years ago

CNNIC has responded: http://www1.cnnic.cn/AU/MediaC/Announcement/201504/t20150402...

1. The decision that Google has made is unacceptable and unintelligible to CNNIC, and meanwhile CNNIC sincerely urge that Google would take users’ rights and interests into full consideration.
2. For the users that CNNIC has already issued the certificates to, we guarantee that your lawful rights and interests will not be affected.

nailer2• 11 years ago

The decision that Google has made is unacceptable and unintelligible to CNNIC

Deciding to not let a company, with the ability to MITM users worldwide, that did not have systems in place to avoid misuse, continue to have that ability?

They also seem to be under the conception that they're in a position to accept or not accept the outcome. That's now this works.

If only CNNIC took being a CA as seriously as they do writing angry press releases.

nailer2• 11 years ago

That's now this works.

Correcting self: that's /not how/ this works.

timdorr• 11 years ago

That's quite a different response from the Google perspective. They make it seem like they came to the mutual decision to remove the CA, not that they kicked out CNNIC.

dreamweapon• 11 years ago

The decision that Google has made is unacceptable and unintelligible to CNNIC,

Standard language of the authoritarian mindset, everywhere.

akhatri_aus• 11 years ago

Does anyone have a list of all typical root CAs and where they are issued from? Are there any other CAs that can be used in rogue ways?

I see a "Hongkong Post Root CA" which I assume can also be used this way?

dredmorbius2• 11 years ago

Debian, Ubuntu, and derived systems can flag CNNIC )if they've installed the 'ca-certificates' package) as untrusted themselves using /etc/ca-certificate.conf:

https://www.reddit.com/r/debian/comments/3167je/blacklisting...

crazychrome2• 11 years ago

Well done! I hope Google would do the same when related to NSA and other 3 letters agencies.

when was the last time Google made headline of hn for its technology?

chippy• 11 years ago

I've no idea about the business of Certificate Authorities. Are they non-profits (like other Internet infrastructure organisations, data centers etc) or corporations?

How much, financially, would this action by Google affect the CNNIC CA?

joopxiv• 11 years ago

They are corporations. Their most important asset is trust, which they need to keep by not signing certificates that can be used for malicious purposes.

The action by Google will definately impact this CA. As soon as this root certificate is no longer trusted, all Chrome users will see big warnings as soon as they visit a website that has a SSL certificate that is signed by them. I don't know the exact market share of Chrome, but I have no doubt it is large enough to make current customers of CCNIC switch to a different CA.

gpvos• 11 years ago

China versus Google. Let me get the popcorn.

istvan__2• 11 years ago

This is just an alarming sign that the entire SSL business is broken. It was exploited so many times by western agencies and also by criminals that it should be clear to everybody that this workflow is broken. This action from Google is an example of double standards. There are CAs from three letter friends in some of the tools we are using today so they can silently mitm attack your SSL traffic. I don't see Google rushing to fix the underlying problem and just trying to mess with China.

ilaksh• 11 years ago

Re: 3 letter friends CAs, I believe it. Sort of have to do that, given their operating goal of being able to read everything at will. Its low-hanging fruit, and the only real reason to continue with such a centralized authority-based scheme is to support that type of thing.

istvan__2• 11 years ago

Well, I would agree with you if this opportunity could not be exploited by malicious organizations.

Google pulling China CNNIC CA from its products

Related Stories