Google: Maintaining digital certificate security

Posted Mar 24, 2015 13:31 UTC (Tue) by ledow (guest, #11753)
In reply to: Google: Maintaining digital certificate security by gerv
Parent article: Google: Maintaining digital certificate security

If something is only used on an internal network, you add it to a trusted certificates list, or sign it with something that is.

If something is signed by a valid CA that users worldwide may end up accepting without question, that's a different story entirely.

If you want to MITM, nobody is stopping you. Sometimes it's necessary. And that's why you use your own certificate chain and add it to the machines somehow (even on BYOD setups).

Generating a certificate for a MITM that is signed by a CA that browsers trust by default, that's just stupid. Sure, it lets you sniff "unknown", and that's exactly the problem. You just broke the chain of trust, deliberately and knowingly. Thus, you have no right to be a CA.

And THIS is why places like Google publish their certificate hashes and have their browsers check for the correct hash so they aren't MITM'd unknowingly.

Google: Maintaining digital certificate security

Posted Mar 24, 2015 13:38 UTC (Tue) by gerv (guest, #3376) [Link]

What did I say that made you think I disagreed with any of that?

Gerv

Google: Maintaining digital certificate security

Posted Mar 24, 2015 21:17 UTC (Tue) by robbe (guest, #16131) [Link] (7 responses)

> If you want to MITM, nobody is stopping you. Sometimes it's necessary. And
> that's why you use your own certificate chain and add it to the machines
> somehow (even on BYOD setups).

But it's not easy nor convenient to do at scale, especially not for for Firefox¹ or mobile devices. For BYOD it may actually incur legal risk².

We sell these MITM proxies at work, and about once a month I have to explain to a customer:

Customer: I want to <X>
Me: You must turn on HTTPS inspection for that to work.
Customer: But the manual says I then have to install a certificate on every device. That's so much bother! Isn't there a better way?
Me: No legal one, no.

¹ Gerv, you still listening? That's my number one pain point for FF on enterprise desktops.
² If I do e-banking from this MITM-ready device, non-repudiation conveniently goes out the window.

Google: Maintaining digital certificate security

Posted Mar 24, 2015 23:00 UTC (Tue) by josh (subscriber, #17465) [Link] (4 responses)

> But it's not easy nor convenient to do at scale, especially not for for Firefox¹ or mobile devices.

Good. It should be absurdly hard. If it were easier, more people would do it.

Google: Maintaining digital certificate security

Posted Mar 24, 2015 23:18 UTC (Tue) by pboddie (guest, #50784) [Link]

Indeed, plenty of unscrupulous people would rather like to be the Superfish in their own little pond.

Google: Maintaining digital certificate security

Posted Mar 25, 2015 6:44 UTC (Wed) by epa (subscriber, #39769) [Link]

I think that's just security through obscurity. It should be possible with a few clicks to add new certificates and set up a MITM proxy, so that the risks are more widely understood. A tamper-proof Firefox is not possible without locking down the whole system - though that may yet prove to be an answer. (I can imagine your phone not allowing you to install different certs, or replace the browser code, without going into 'developer mode' which flashes a big red warning. So then if you are using a name-brand phone you bought new from the shop, you have some confidence it can communicate securely. If (a big if) you trust the phone maker, that is...)

Google: Maintaining digital certificate security

Posted Mar 26, 2015 21:30 UTC (Thu) by robbe (guest, #16131) [Link] (1 responses)

So above (637615) you are saying, that you support the right of the employer to intercept (I don't by the way) ... but it should be made as hard as possible?

Unfortunately, the employer will just stay with IE in this case. Not installing Firefox is certainly easier than rolling it out *and* fudging one or more certificates into its trusted store.

Maybe a better way is to make adding a MITM cert easier, but show a different visual cue in the "security indicator" next to the URL. Example:

Padlock: we're pretty sure nobody can listen in
Stethoscope: someone is watching your decrypted traffic, ostensibly for malware, but insulting your boss or planning a coup is probably not a good idea either
Megaphone: only politeness protects you, don't do anything you wouldn't do in the cafeteria

Google: Maintaining digital certificate security

Posted Mar 26, 2015 22:19 UTC (Thu) by josh (subscriber, #17465) [Link]

To clarify, I'm not saying it should be gratuitously difficult to add a new CA to a machine you control/administer. I'm just saying that you should never be able to MITM traffic *without* that step, such as with a certificate chaining to a CA already in browsers. When I said it should be difficult, I just mean that I have zero sympathy for prospective eavesdroppers complaining that it's too hard to install a new CA on every device.

As far as the right to do so: in my opinion, the provider of a network can intercept traffic if they want, but should not be allowed to do so without notice and consent.

Google: Maintaining digital certificate security

Posted Mar 25, 2015 11:52 UTC (Wed) by rich0 (guest, #55509) [Link]

Just another reason companies shouldn't be doing something like BYOD unless it involves VMs or such. If a company wants to MITM all traffic from a mobile device, they should just provide it.

Google: Maintaining digital certificate security

Posted Mar 25, 2015 12:34 UTC (Wed) by gerv (guest, #3376) [Link]

robbe: talk to the folk on our Enterprise mailing list - https://wiki.mozilla.org/Enterprise - or to Mike Kaply, who has made a Client Customization Kit (CCK) which does this sort of thing, and is available for consulting.

Gerv