6 ms·

I trust Mozilla more than Microsoft. Is there any way to simply purge all Windows certs and import everything from cert8.db?

by Teapot 11y ago

jahnu 11y ago
I don't think we can really trust anyone more than anyone else any more. I think it would be trivial for any three letter agency to insert, blackmail and/or buy employees anywhere they want.
- carboncopy 11y ago
  Why do you think it would be trivial for three-letter agencies to do those things? Is there a legal mechanism, authority, or track record for such a thing? If you're talking about Dual_EC_DRBG, that was a non-trivial, poorly-kept secret that failed on launch. An alleged $10 million secret deal, plus development of the algorithm doesn't sound trivial to me.
  - JupiterMoon 11y ago
    You have heard the news since Snowden whistle-blew right?
  - clord 11y ago
    I think jahnu was referring to obtaining the private keys for a trusted signing authority, which would enable said agency to create valid-looking certificates for the purpose of MITM. Weak algorithms are also concerning, but not really the subject of OP.
  - captainmuon 11y ago
    > Is there a legal mechanism, authority, or track record for such a thing? The problem is, as a layman, I cannot know. I wouldn't have thought that something like FISA court orders was possible, where you get a secret order from a semi-secret court and you are not even allowed to talk about it. Who knows, maybe there is a secret FOOBAR law that says agents can force any certificate agency to sign random certificates for them. Maybe some wierd agency you never heard of forced every major manufacturer to include hardware backdoors, and lie about it. A few years ago I wouldn't have thought that was possible. But my trust that the legal system is democratic and transparent has been thoroughly undermined. Now, if you run a business and some people in suits come and order you to install a backdoor, and threaten you, and tell you you can't talk about the incident to anybody besides your laywer, you can't do anything about it - and you better hope that that lawyer is good, since otherwise you have no way of telling whether that order is legitimate or not. Those people might as well be criminals, and you have almost no way to find out. Back in the pre-9/11 world, if you didn't recognize the IDs of the, say, FCK agency, you would have phoned around a bit and then told them to f'ck off after hearing their outlandish demands. Because there is no way something like that would happen in our democratic country. You can't assume that anymore nowadays.
    - JupiterMoon 11y ago
      > to anybody besides your laywer I think that Snowden's email provider was not even allow to talk about things with their lawyers at some point in time...
    - carboncopy 11y ago
      A simple "no, I don't actually know" would have sufficed. I'm not asking you what episode of Blacklist you enjoyed the most, I'm asking you about real life. The lavabit company was served a real warrant made by a real judge, served by a real officer of the court. NSLs are served by real FBI agents with real badges. I'm not debating the anti-liberty essence of an NSL, but the "men in black" fear is completely unfounded by the domain of things that are in the public eye. The strawman of the "FCK agency" agents ordering people with the threat of jail time to put backdoors in their software isn't backed up by any credible fact. We can suppose and assume all day, but you shouldn't take it for granted that everyone agrees or should agree with you. *the alleged RSA backdoor was reported by Reuters to be a $10M bribe, doesn't sound coercive to me. Not to mention the NSA has no arrest powers outside its facilities, but sure.
  - rtpg 11y ago
    A NSL could set up the gag order, and it could be part of the whole "need to listen to data coming in from abroad" parts of the Patriot Act (though I think USA FREEDOM removed some of that?) I think that even in the current state of things there's not much standing for the NSA to force that to happen.
- Manishearth 11y ago
  In an open source store with an open process like Mozilla's someone's bound to notice. (actually, I'm not sure if Mozilla even can push certs without an explicit update)
  - nolok 11y ago
    Mozilla and its foundation being US based, they can be the target of a gag order, making them liable if they disclose/talk about/hint of "fake" root cert added for the sake of an agency. Once you start playing with gag orders, secret courts and whatnot, all kind of fun stuff become possible.
    - jsprogrammer 11y ago
      Alleged liability. Many seem to think that those actions of the US government are not legally allowed. Most likely there is no real liability for not following a gag order as speech is pretty unambiguously protected from being regulated or circumscribed by the US government.
    - rbanffy 11y ago
      Except corrupting the source code from which packages are built. At least without anyone outside noticing because the code is public and I bet foreign intelligence agencies that do not trust Microsoft to make IE secure for them are monitoring the change stream.
Maarten88 11y ago
Making a utility for that would not be too hard. But it would probably kill things like the Windows Update process. The Windows certificate store is system wide, and is used for other things besides http.
throwaway5435 11y ago
The Microsoft Root CA cert is not included in the NSS trust store. This would break Windows Update (something that Samsung has recently been accused of breaking). So you have to trust the Microsoft CA Root Cert; And if you trust that, you trust they won' sign a SubCA cert, which they could do. If you don't trust your trust provider, don't use their software?
- e12e 11y ago
  But there are different degrees of paranoia. I'm fine(ish) with trusting Microsoft to sign drivers, updates and applications. I'm also fine with them signing for outlook.com, microsoft.com etc. I'm not fine with them signing for wikileaks -- but I also am not really worried about that. I'm worried that some fly-by-night CA will loose their keys, get hacked, etc. So I don't want any more than a minimum of CAs on my system, and I'd like to approve them on a domain-by-domain basis. Even with good UX, that'd bee way more hassle than most people want -- I know that. But it would've been nice to have a sane option for it. And also some special control over updates/upgrades to the CA-cert store. In short, I trust Microsoft to write software, I don't trust them to delegate trust, because they're trapped in the CA racket.
  - jsprogrammer 11y ago
    How can you trust wikileaks on a non-MS CA if you are viewing wikileaks on MS software? CA protects nothing from the underlying application, operating system, and device drivers.
    - e12e 11y ago
      I trust MS software. I don't trust MS to select which CA to trust. Sure, MS could backdoor my os/browser. I don't think that's very likely. If MS force me to trust, say 800 CA certs, and all of them can mitm wikileaks, the likelihood that one of them could be penetrated by a hacker or a state actor is much higher. Sure, it's not "absolute security", but nothing is. There are different concept that one trusts, or not trust: The os, drivers, bios, hardware. I generally trust that. It may be naive, but I do. However, even if I'm right in trusting that, that doesn't matter if I can't trust all the CAs. Not just from the point of malicious actions by the CAs, but from incompetence by them.

I trust Mozilla more than Microsoft. Is there any way to simply purge all Windows certs and import everything from cert8.db?

by Teapot 11y ago

I trust Mozilla more than Microsoft. Is there any way to simply purge all Windows certs and import everything from cert8.db?

jahnu 11y ago

I don't think we can really trust anyone more than anyone else any more. I think it would be trivial for any three letter agency to insert, blackmail and/or buy employees anywhere they want.

carboncopy 11y ago
Why do you think it would be trivial for three-letter agencies to do those things? Is there a legal mechanism, authority, or track record for such a thing? If you're talking about Dual_EC_DRBG, that was a non-trivial, poorly-kept secret that failed on launch. An alleged $10 million secret deal, plus development of the algorithm doesn't sound trivial to me.
- JupiterMoon 11y ago
  You have heard the news since Snowden whistle-blew right?
- clord 11y ago
  I think jahnu was referring to obtaining the private keys for a trusted signing authority, which would enable said agency to create valid-looking certificates for the purpose of MITM. Weak algorithms are also concerning, but not really the subject of OP.
- captainmuon 11y ago
  > Is there a legal mechanism, authority, or track record for such a thing? The problem is, as a layman, I cannot know. I wouldn't have thought that something like FISA court orders was possible, where you get a secret order from a semi-secret court and you are not even allowed to talk about it. Who knows, maybe there is a secret FOOBAR law that says agents can force any certificate agency to sign random certificates for them. Maybe some wierd agency you never heard of forced every major manufacturer to include hardware backdoors, and lie about it. A few years ago I wouldn't have thought that was possible. But my trust that the legal system is democratic and transparent has been thoroughly undermined. Now, if you run a business and some people in suits come and order you to install a backdoor, and threaten you, and tell you you can't talk about the incident to anybody besides your laywer, you can't do anything about it - and you better hope that that lawyer is good, since otherwise you have no way of telling whether that order is legitimate or not. Those people might as well be criminals, and you have almost no way to find out. Back in the pre-9/11 world, if you didn't recognize the IDs of the, say, FCK agency, you would have phoned around a bit and then told them to f'ck off after hearing their outlandish demands. Because there is no way something like that would happen in our democratic country. You can't assume that anymore nowadays.
  - JupiterMoon 11y ago
    > to anybody besides your laywer I think that Snowden's email provider was not even allow to talk about things with their lawyers at some point in time...
  - carboncopy 11y ago
    A simple "no, I don't actually know" would have sufficed. I'm not asking you what episode of Blacklist you enjoyed the most, I'm asking you about real life. The lavabit company was served a real warrant made by a real judge, served by a real officer of the court. NSLs are served by real FBI agents with real badges. I'm not debating the anti-liberty essence of an NSL, but the "men in black" fear is completely unfounded by the domain of things that are in the public eye. The strawman of the "FCK agency" agents ordering people with the threat of jail time to put backdoors in their software isn't backed up by any credible fact. We can suppose and assume all day, but you shouldn't take it for granted that everyone agrees or should agree with you. *the alleged RSA backdoor was reported by Reuters to be a $10M bribe, doesn't sound coercive to me. Not to mention the NSA has no arrest powers outside its facilities, but sure.
- rtpg 11y ago
  A NSL could set up the gag order, and it could be part of the whole "need to listen to data coming in from abroad" parts of the Patriot Act (though I think USA FREEDOM removed some of that?) I think that even in the current state of things there's not much standing for the NSA to force that to happen.
Manishearth 11y ago
In an open source store with an open process like Mozilla's someone's bound to notice. (actually, I'm not sure if Mozilla even can push certs without an explicit update)
- nolok 11y ago
  Mozilla and its foundation being US based, they can be the target of a gag order, making them liable if they disclose/talk about/hint of "fake" root cert added for the sake of an agency. Once you start playing with gag orders, secret courts and whatnot, all kind of fun stuff become possible.
  - jsprogrammer 11y ago
    Alleged liability. Many seem to think that those actions of the US government are not legally allowed. Most likely there is no real liability for not following a gag order as speech is pretty unambiguously protected from being regulated or circumscribed by the US government.
  - rbanffy 11y ago
    Except corrupting the source code from which packages are built. At least without anyone outside noticing because the code is public and I bet foreign intelligence agencies that do not trust Microsoft to make IE secure for them are monitoring the change stream.

Maarten88 11y ago

Making a utility for that would not be too hard. But it would probably kill things like the Windows Update process. The Windows certificate store is system wide, and is used for other things besides http.

throwaway5435 11y ago

The Microsoft Root CA cert is not included in the NSS trust store. This would break Windows Update (something that Samsung has recently been accused of breaking). So you have to trust the Microsoft CA Root Cert; And if you trust that, you trust they won' sign a SubCA cert, which they could do. If you don't trust your trust provider, don't use their software?

e12e 11y ago
But there are different degrees of paranoia. I'm fine(ish) with trusting Microsoft to sign drivers, updates and applications. I'm also fine with them signing for outlook.com, microsoft.com etc. I'm not fine with them signing for wikileaks -- but I also am not really worried about that. I'm worried that some fly-by-night CA will loose their keys, get hacked, etc. So I don't want any more than a minimum of CAs on my system, and I'd like to approve them on a domain-by-domain basis. Even with good UX, that'd bee way more hassle than most people want -- I know that. But it would've been nice to have a sane option for it. And also some special control over updates/upgrades to the CA-cert store. In short, I trust Microsoft to write software, I don't trust them to delegate trust, because they're trapped in the CA racket.
- jsprogrammer 11y ago
  How can you trust wikileaks on a non-MS CA if you are viewing wikileaks on MS software? CA protects nothing from the underlying application, operating system, and device drivers.
  - e12e 11y ago
    I trust MS software. I don't trust MS to select which CA to trust. Sure, MS could backdoor my os/browser. I don't think that's very likely. If MS force me to trust, say 800 CA certs, and all of them can mitm wikileaks, the likelihood that one of them could be penetrated by a hacker or a state actor is much higher. Sure, it's not "absolute security", but nothing is. There are different concept that one trusts, or not trust: The os, drivers, bios, hardware. I generally trust that. It may be naive, but I do. However, even if I'm right in trusting that, that doesn't matter if I can't trust all the CAs. Not just from the point of malicious actions by the CAs, but from incompetence by them.