Mozilla and CNNIC [LWN.net]

Mozilla and CNNIC

Posted Feb 4, 2010 4:40 UTC (Thu) by jimparis (subscriber, #38647)
In reply to: Mozilla and CNNIC by erwbgy
Parent article: Mozilla and CNNIC

> Then the proxy was changed to replace every destination SSL server
> certificate with a new server certificate with the same details signed by
> the internal CA. As far as the browser is concerned the server certificate
> is valid: the CN field matches the server hostname and the certificate is
> signed by a trusted CA.
>
> Something similar could be done by any trusted CA that is able to
> intercept and modify traffic between the client browser and the
> destination server.

Yes, definitely. That's the main concerned being raised here. But Mozilla's point is that this is a traceable attack -- the end user can simply save a copy of the new, modified certificate as evidence that the proxy/government/whatever was doing it. While it's true that their browser will accept it without complaining, all the user has to do is glance at the issuer to see if it was the rogue CA or not. At that point, you'd send this proof to Mozilla and they would blacklist the CA.

(Log in to post comments)

Mozilla and CNNIC

Posted Feb 5, 2010 15:14 UTC (Fri) by __alex (subscriber, #38036) [Link]

How is the attack detectable at all given standard user practices?

HTTPS security is multi-layered and not simply provided by cryptographic
functions. Things such as the pad-lock icon and the EV-SSL green address
bar UI a major components of the system and currently there is no part of that
system designed for detecting a MITM attack from a trusted authority.

Browsers have no standard mechanism for alerting users about changes in
certificates over time and there is no way for a user to tell what authority the
website provider intended to sign their content with.

This is not a reason to distrust CNNIC specifically, simply a weakness of SSL in
general.

Mozilla and CNNIC

Posted Feb 5, 2010 15:48 UTC (Fri) by jimparis (subscriber, #38647) [Link]

I imagine it will happen like this, if it's indeed true that CNNIC is doing bad things:
- Some user manually removes (or doesn't yet have) the CNNIC certificate
- When visiting a normal site like Gmail, they get a certificate error.
- They look at the certificate, notice it was issued by CNNIC, and complain publically.
- Mozilla removes the certificate for everyone.