CNNIC's response to Google

http://www1.cnnic.cn/AU/MediaC/Announcement/201504/t20150402_52049.htm

by paradite • 11 years ago

143 83 11 years ago

www1.cnnic.cn

China's response is kind of funny. But if they have no bad intentions, they can just implement CT and not have to worry about it. Of course, if you read between the lines in the last paragraph, you realize that they do have bad intentions. That last line is quite 1984-ish.

zenincognito• 11 years ago

This will head towards a tit for tat thing. Much like the cold war except this time its cyber in nature.

nickodell• 11 years ago

2. For the users that CNNIC has already issued the certificates to, we guarantee that your lawful rights and interests will not be affected.

...

Does that mean anything?

notatoad• 11 years ago

It probably means that the CNNIC certs will still be valid in China, as Google doesn't directly distribute any software there directly and the Chinese government can tell the Chinese software vendors to trust its cert regardless of what google thinks.

kijin2• 11 years ago

Their lawful rights and interests will not be affected because, in the opinion of the Chinese government, anyone who uses Chrome in China is doing so unlawfully! (Last time I checked, the GFW blocked Chrome downloads.)

netheril962• 11 years ago

Except there are plenty of Chinese websites (including Baidu) that offer the latest Chrome downloads. In fact, the majority of my friends (I am a Chinese) all use Chrome and they are not software developers. Many Chinese websites are tested against Google Chrome (in addition to IE and Firefox). Put simply, people in China act as if Google Chrome were not blocked at all.

mspecter• 11 years ago

"...meanwhile CNNIC sincerely urge that Google would take users’ rights and interests into full consideration"

And that, ladies and gentlemen, is exactly what they're doing.

dsl2• 11 years ago

CNNICs users' rights and interests are not being taken into consideration. Make no mistake, they are looking to protect their customers, not you and I.

jsprogrammer2• 11 years ago

Right, their users are the ones who purchase certs, not browsers.

kijin2• 11 years ago

Who are the people and companies that use CNNIC-issued certificates?

CNNIC is a relatively recent addition to most browsers' lists of trusted CAs. Moreover, given the popularity of pirated & never-updated Windows XP in China, it would have been foolish for any serious Chinese business to use an SSL certificate from any vendor other than globally recognized ones like Comodo and Verisign.

yuhong• 11 years ago

I think WinXP has come with separate auto root update since RTM.

tifan• 11 years ago

Did you know most Chinese browser vendors will explicitly disable SSL certificate validity check?

ncza• 11 years ago

Proof please

neumino2• 11 years ago

With great power comes great responsibility. It's not because there were no misuse of the certificates this time that it didn't happen or would have not happen.

I personally have removed their certificates from my system. This is the responsible move to do if you care about your security or don't want your computers to be used as part of the DDoS like we've seen against GitHub.

bigiain6• 11 years ago

Does anyone know if there's a way yet to do this on unjailbroken iOS devices?

This suggests no: http://apple.stackexchange.com/questions/23720/how-do-i-un-t...

ikeboy• 11 years ago

It looks like not, but here's a list if it helps http://karl.kornel.us/2014/09/an-analysis-of-the-cas-trusted...

logotype• 11 years ago

Here's how to remove CNNIC from OSX (check two first commands only) https://github.com/logotype/useful-unix-stuff/blob/master/us...

Hope someone finds this useful!

ishtu• 11 years ago

It tells me

  security: SecTrustSettingsRemoveTrustSettings (user): No Trust Settings were found.
  security: SecTrustSettingsRemoveTrustSettings (admin): No Trust Settings were found.

mirashii2• 11 years ago

don't want your computers to be used as part of the DDoS like we've seen against GitHub.

Let's not conflate two mostly unrelated things here. Removing this root certificate does nothing to stop this attack against Github.

neumino2• 11 years ago

It prevents your computer from loading undesired piece of JavaScript in case of a MITM attack. It doesn't prevent things if the server itself serve you malware, but that's another story.

vilda• 11 years ago

On Debian and Ubuntu systems run this through sudo or as root:

    dpkg-reconfigure ca-certificates

And select/deselect CAs you trust.

dredmorbius• 11 years ago

Or edit /etc/ca-certificates.conf directly and run update-ca-certificates afterwards (as the file advises).

I'm normally a fan of dpkg-reconfigure, but in this case, paging through 25 screens of 6 certs at a time, without search, is a far worse case than firing up your preferred browser, finding the root you want to revoke, and planting a bang '!' in front of it.

Otherwise, the processes vilda and I describe are identical.

bigiain6• 11 years ago

This is going to be interesting.

My gut feel is that "rogue root CAs" need to have the fear of having their entire business shut down if they're caught out acting badly, and that CNNIC is the ideal opportunity for US-centric technology companies to take a stand without treading on too many profitable toes. If Microsoft and Apple joined in solidarity and announce they're taking CNNIC out of trusted roots (and, to a lesser extent, Mozilla), then it will be clear that the threats to CA's business/profit have some teeth.

If they let this slide - it'll pretty much be open season for root trusted MITM certs to anyone with a few kilo or mega bucks to spare. It won't stop state-level actors from doing state-level bad-stuff(tm), but it might at least stop them from selling that ability to random big-corps as well.

(And surely the opportunity to stand up to the Chinese Government with broad internet-community backing, especially in the face of the recent Github DDOS - the timing is about as perfect as it's ever likely to get, right?)

jeswin• 11 years ago

According to Tim Cook, China is becoming Apple's biggest Market. Microsoft software is similarly entrenched in China. There is no way those companies will do anything that jeopardizes that relationship.

I salute Google. For all its forgivable flaws, it stands alone among large corporations in protecting free speech. And the nerve to pull out of the largest internet market on the planet. Kudos.

beaner• 11 years ago

That's because everything is growing in China, including probably Android and Chromebooks. Google just had the guts to do the right thing.

jsprogrammer2• 11 years ago

Your browser, or trusted cert provider, should just have a clear policy that once trust is broken, according to well defined rules, the cert is auto-revoked with no appeal. Then it is only a matter of executing the policy, not an ex post facto political game.

If your trusted source does not have such a policy, drop them.

mcintyre1994• 11 years ago

I know it's a bit off topic but I would seriously love to have been a fly on the wall when Apple secured a deal with the likes of China Mobile. There must be conditions attached to access to the largest carrier in the world that just happens to be owned by the Chinese state - especially for a US company with their data collection abilities.

toyg2• 11 years ago

it stands alone among large corporations in protecting free speech.

As seen in the last few years, Google has a fairly cozy relationship with the US government and intelligence community, so I don't think they're doing this just to "protect free speech". Besides, breaking SSL goes well beyond free speech (e.g. industrial espionage etc).

methou3• 11 years ago

The business is between Apple and Chinese people, not between Apple and CNNIC or its evil spawn. They have no reason to keep that rogue root of CNNIC's to protect its users for greater good.

nickysielicki2• 11 years ago

How far away are we from being able to kill this ridiculous system? I'm sick of trusting a bunch of certs that are deemed acceptable. Forget security concerns, I'm just appalled that to acceptably do encryption today I need to pay some company! That's wrong.

Okay, so the question isn't actually "how we're going to kill it". It's going to die when there's a better alternative. So the question is really, "What can we do to build a strong web-of-trust system while continuing to use the broken one?"

I see no reason we can't make some browser plugins, get some activism going in the tech community, and start building it. Just report back what cert was served to you.

With that being said, there needs to be a selling point other than building a better internet, otherwise no one will use this plugin. I think there is one, though, and that's security. When your browser comes across a cert that differs, alert the user. You might not get grandma to use it, but it's something.

There are issues with this. I want to anonymously report what cert a website serves me, rather than giving anyone curious my entire browsing history. And also poisoning. But the latter is fixed by using this both the existing CA model and the WoT.

So yes, there are some problems. But c'mon, it's 2015, let's fix this already.

rtpg2• 11 years ago

I don't get how it's ridiculous. How do I know that Bank of America's website is actually Bank of America? At least I know _somebody_ checked that it was BoA who is controlling the domain.

It's obviously far from 100%, but the web of trust has to start somewhere. Distributed web-of-trust works for individuals, but am I supposed to go see Jeff Beezos in meatspace before going to amazon.com?

The solution is, of course, delegation. But the end result is you end up with exactly the same CA system as today!

dmichulke• 11 years ago

Trustworthy entities (e.g, Mr Schneier and Krebs and whoever they trust) could just offer a signed list of pub-key - identity pairs which can be stored in the block chain.

The amount of work needed should be pretty low, they start with the current certificate tree and they just need to update in case of a certificate incident (they probably get this info fast and the update should be easy to do via software). Probably they could sustain this service via donations.

geofft4• 11 years ago

Forget security concerns, I'm just appalled that to acceptably do encryption today I need to pay some company! That's wrong.

Well, you don't need to pay anyone to do encryption. You do need to do pay people to do identity verification. That's a more-than-pedantic difference, even though encryption without identity verification is generally meaningless.

First off, you're already paying someone to have a domain name. I sorta understand the distaste on principle, but I've never really understood, as a practical matter, why paying $10+/year for a domain name is totally fine, but paying $5/year on top of that for SSL isn't. (And yes, the race-to-the-bottom has hit $5, see ssls.com. This isn't even counting StartCom and the future Let's Encrypt.)

Second, and related to that, what you're paying them for is the human element in key continuity. If you ever lose your key, you're going to want to be able to regain a key for the same website that you've already published everywhere, that everyone already has localStorage for, etc. And be careful about saying that you don't care: Crypto.cat (which, at this point, definitely knows what they're doing) managed to lock themselves out from SSL by requesting a hardcoded public-key pin and then losing all the public keys they'd pinned. This isn't really a risk that you think is realistic until disaster strikes, and the last thing you want in the middle of a disaster is to have to rename your website and convince everyone that they should use the new site.

And the process of maintaining infrastructure to re-provision certificates to people costs money. It's possible that it could be funded in different ways (just like, e.g., all of the work that goes into the browsers themselves is funded in ways that don't involve charging website owners or users). But there is a thing there that involves humans, there are advantages to it involving humans, and humans need to be paid.

aburan28• 11 years ago

A better solution could be viable but there are entire companies based upon the pki infrastructure.

mike_hearn• 11 years ago

Why you think the PKI sucks but can't do any better:

https://medium.com/@octskyward/why-you-think-the-pki-sucks-b...

I wrote this article for the Bitcoin community but most of the logic stands for the web too.

rakoo• 11 years ago

Some pointers for you:

- The Perspectives project (http://perspectives-project.org/) aimed to deploy a range of servers (called notaries), through which you can ask "What cert do you see for https://google.com ?", and compare the response. The idea was that certificates should be mostly the same wherever you're asking from.

- Convergence (https://en.wikipedia.org/wiki/Convergence_(SSL)) is a fork of the same idea.

The issue with both of them is, of course, privacy leaks, which the latest version of convergence (https://github.com/mk-fg/convergence#changes-from-upstream) solves with a custom onion routing. The other problem I see is that it still (in the current form) requires the user to manually edit the notaries list.

So, it does exist, maybe it's just lacking publicity ?

methou3• 11 years ago

CNNIC is no ordinary CA we are talking about that fears out-of-service. Just like what its name states: China NIC, it is the entity that runs and manages whole block of Chinese part of internet, doing IP allocations and things like that.

even if everybody decides to take CNNIC root out of their system, I doubt how much it would influence the CNNIC.

bigiain6• 11 years ago

At a first guess - any Chinese business wanting to do business with non-Chinese would then have websites which throw up warnings about their CNNIC issued SSL Certs. Surely _some_ of them would see a competitive advantage o the market by going to a non-CNNIC cert? And if the rules make that awkward, surey some of them will choose to host competitive customer marketing sites outside The Great Firewall? By selling inappropriately powerful certs to MCS Holdings, there's a chance they're going to lose some of their understood-but-ignored ability to MITM some (many?) Chinese corporate connections from outside China.

throwaway7767• 11 years ago

If they let this slide - it'll pretty much be open season for root trusted MITM certs to anyone with a few kilo or mega bucks to spare.

It's too late. TrustWave got a pass when they did the exact same thing. The message has been sent, there are no repercussions for willfully abusing your CA status. Only incompetence will be punished (DigiNotar).

The CA system is broken. We will never find any authority that everyone in the world agrees to trust.

DigitalSea• 11 years ago

Not really much of a response from CNNIC here. Notice how they spin this situation as Google taking away the rights of others? Google isn't the bad guy here, they're doing the reasonable thing and CNNIC have a lot of explaining to do...

fit2rule• 11 years ago

Those "others" = the Chinese government.

nnrocks• 11 years ago

Very true said. Gaining security is always in favor of public and organizations. Google is a authority, and many people take its statement seriously rather than others. And this approach may really take internet to safe side at some point. Nowadays ssl can be found at no price. Letsencrypt is going to provide at free of cost and vendors (like ssl.com and cheapsslshop.com ) selling such certs from nominal fee of $4 - $5 per year. Infact Government organization should shake hand with Google and motivate people to adopt such security asap.

jtokoph• 11 years ago

I find it interesting that visiting the https version of cnnic.cn in Chrome neither displays a lock icon nor a warning, but the certificate is displayed as valid: http://i.imgur.com/fTzxpBh.png

duskwuff• 11 years ago

Related to their use of SHA1 on the certificate: http://googleonlinesecurity.blogspot.com/2014/09/gradually-s...

geofft4• 11 years ago

Yup, this is it. The cnnic.cn end-entity certificate is SHA-1, which would do it. (I believe there's some sadness involved like Windows XP being excessively prevalent in China, or something... I vaguely recall a discussion of this on the cabforum public list, but I can't find it now.)

If you click on the white page icon and go to the "Connection" tab, it'll say "This site is using outdated security settings," which generally (always, in current Chrome versions?) means SHA-1.

dsl2• 11 years ago

Google is explicitly whitelisting the legitimate end-user certificates CNNIC has issued, and then revoking the root.

Basically they had to hand over a list of all issued certificates, Google reviewed them, and CNNIC can't issue any new ones without asking Google to whitelist it.

cskau• 11 years ago

Quite the contrast to Google's response:

    We applaud CNNIC on their proactive steps, and welcome them to reapply once suitable technical and procedural controls are in place.

ttflee• 11 years ago

Interestingly, I cannot get round of CNNIC, as I am likely to operate some services for my employer on Windows Azure in China.

http://www.cnnic.cn/jczyfw/fwqzs/fwqzsdtgg/201403/t20140312_...

Microsoft is using CNNIC certs for their Windows Azure services in China (, which of course is independent from Azure services in other regions, and is jointly operated with Chinese partners).

If I marked CNNIC CA as untrustworthy, I would be expecting some alert in my Dashboard page, I guess.

codert• 11 years ago

CNNIC,you deserve it!

1019143• 11 years ago

I know a user who runs her own root CA.

She only has one "customer": herself.

Using the OpenSSL binary the cost is free.

She decides which hosts she wants to trust, obtains their certs and signs them.

She believes she can trust her own CA more than any commercial, third party CA.

peteretep• 11 years ago

How does she verify the certs she's getting?

1019143• 11 years ago

How do the commercial CA's verify customers before issuing certs?

Perhaps she does what they do.

I imagine for example she knows her banker, her lawyer, etc. and can contact them by phone or meet with them in person.

Maybe she also uses her friends to help her decide who to trust.

She only has to verify a relatively small number of hosts compared to a commercial CA.

CNNIC's response to Google

Related Stories