8 ms·

From what I understand of Superfish, Mozilla (and other browser vendors) can't just blacklist the certificate. That would make all HTTPS connections error out.

by gluxon 12y ago

From what I understand of Superfish, Mozilla (and other browser vendors) can't just blacklist the certificate. That would make all HTTPS connections error out. A message notifying users of the issue is all they can do.

yuhong 12y ago
On the other hand, this is making the news.
userbinator 12y ago
One way would be to bypass the proxy if it's detected as a Superfish proxy by its certificate, but somehow I feel like this isn't a problem the browser vendors should be doing extra workarounds for (and giving precedence to "if we don't like your proxy we'll ignore it" isn't a great idea either.)
- maxerickson 12y ago
  It doesn't appear to be implemented as a user visible proxy, it modifies the network stack. From: https://twitter.com/matthew_d_green/status/568437037906444288 https://twitter.com/matthew_d_green/status/56843703790644428... Probably not a proxy; probably low-level socket interception in Windows. So there isn't much the browsers can do to help the user. At least the technical side of Lenovo's response is all the way to "We are writing a program to remove the certificates", which is probably the thing that is going to impact the most people.
beagle3 12y ago
They definitely can blacklist the certificate. They have the choice of having HTTPS effectively useless (by leaving the certificate there), or making HTTPS not work (by removing it, thus prompting action from the user to fix it -- perhaps by calling their tech savvy nephew). Browser vendors should (and usually do) err on the side of security.
- Xylakant 12y ago
  Or the users just switch to a browser that works. IE or Chrome :(
  - beagle3 12y ago
    Most Firefox users switched away from those (or didn't switch to them) because it works better for them - including security wise. I suspect that won't be their first course of action.
  - deleted 12y ago
    [deleted]
raverbashing 12y ago
That's not their problem. It's Lenovo who'll be getting the support calls for their defective, sorry, "enhanced" product
- armb 12y ago
  If the user installs a Firefox update and then all their HTTPS connections stop working, most users will blame Firefox unless the error messages are very specific about Lenovo's involvement, which simple blacklisting won't do. Users who follow technical news and understand the problem will already have removed the certificate manually (and removed the proxy).
  - TeMPOraL 12y ago
    I doubt it. Most non-techie users will probably not get around to installing another browser, so seeing that neither bank nor gmail nor facebook works, they'll blame their ISP.
    - evilpie 12y ago
      But most people already have IE installed!

by gluxon 12y ago

yuhong 12y ago

On the other hand, this is making the news.

userbinator 12y ago

One way would be to bypass the proxy if it's detected as a Superfish proxy by its certificate, but somehow I feel like this isn't a problem the browser vendors should be doing extra workarounds for (and giving precedence to "if we don't like your proxy we'll ignore it" isn't a great idea either.)

maxerickson 12y ago
It doesn't appear to be implemented as a user visible proxy, it modifies the network stack. From: https://twitter.com/matthew_d_green/status/568437037906444288 https://twitter.com/matthew_d_green/status/56843703790644428... Probably not a proxy; probably low-level socket interception in Windows. So there isn't much the browsers can do to help the user. At least the technical side of Lenovo's response is all the way to "We are writing a program to remove the certificates", which is probably the thing that is going to impact the most people.

beagle3 12y ago

They definitely can blacklist the certificate. They have the choice of having HTTPS effectively useless (by leaving the certificate there), or making HTTPS not work (by removing it, thus prompting action from the user to fix it -- perhaps by calling their tech savvy nephew). Browser vendors should (and usually do) err on the side of security.

Xylakant 12y ago
Or the users just switch to a browser that works. IE or Chrome :(
- beagle3 12y ago
  Most Firefox users switched away from those (or didn't switch to them) because it works better for them - including security wise. I suspect that won't be their first course of action.
- deleted 12y ago
  [deleted]

raverbashing 12y ago

That's not their problem. It's Lenovo who'll be getting the support calls for their defective, sorry, "enhanced" product

armb 12y ago
If the user installs a Firefox update and then all their HTTPS connections stop working, most users will blame Firefox unless the error messages are very specific about Lenovo's involvement, which simple blacklisting won't do. Users who follow technical news and understand the problem will already have removed the certificate manually (and removed the proxy).
- TeMPOraL 12y ago
  I doubt it. Most non-techie users will probably not get around to installing another browser, so seeing that neither bank nor gmail nor facebook works, they'll blame their ISP.
  - evilpie 12y ago
    But most people already have IE installed!