Fraudulent *.google.com certificate issued

Posted Aug 30, 2011 12:58 UTC (Tue) by mjw (subscriber, #16740)
Parent article: Fraudulent *.google.com certificate issued

This seems pretty bad for Dutch citizens. The revoked root certificate was also used for the national government Digital Identity site DigiD.nl. You need to authenticate through DigiD to submit Dutch tax forms for example...

Dutch coverage:
http://tweakers.net/nieuws/76461/firefox-vertrouwt-certif...

Fraudulent *.google.com certificate issued

Posted Aug 30, 2011 13:06 UTC (Tue) by lkundrak (subscriber, #43452) [Link] (2 responses)

This is similar to usual situation around here.

Both Czech and Slovak tax offices (and supposedly more government sites) use CAs that are not bundled with any browser/OS (similarly called "First Certificating" in both countries). Moreover, if you attempt to verify the certificate via phone noone even knows what a fingerprint is. I probably don't want to know how much did the certificates cost.

Fraudulent *.google.com certificate issued

Posted Aug 30, 2011 13:30 UTC (Tue) by cesarb (subscriber, #6266) [Link]

It is the same here in Brazil, see https://bugzilla.mozilla.org/show_bug.cgi?id=438825 (the tax office is https://www.receita.fazenda.gov.br/).

The trick I use is, whenever installing a new computer, go to https://www.mozilla.org/projects/security/certs/pending/, which has both the links to the correct root certificates for ICP-Brasil and their fingerprints (they are what Mozilla will add if/when the CA is accepted). Just click on each one, set the correct trust bits (also listed in that page - in ICP-Brasil's case, it is only "Websites"), compare the fingerprint, and done. Just remember to check you are using https for that page.

Fraudulent *.google.com certificate issued

Posted Aug 30, 2011 16:36 UTC (Tue) by iabervon (subscriber, #722) [Link]

I assume the tax offices also distribute information to the public that needs to be correct to protect people's privacy; if someone made tax form booklets that told you to send the forms to an attacker (who would then send them on to the correct address, having copied them), they could steal all sorts of information. If these official mailings included the CA fingerprint where they tell you about the web site, it would be more secure than what Google does, because an attacker couldn't just hack into some insecure CA and get a fraudulent certificate that would act the way the booklet tells you to expect.