Security-X
Forum Security-X => News => Discussion démarrée par: igor51 le avril 01, 2012, 19:03:38
-
When Certificate Authority Business Models and Vendor Certificate Policies Clash
<P> A very important “internet trust” discussion is underway that has been hidden behind closed doors for years and in part, still is. While the <a href=https://www.securelist.com/en/blog/6153/A_Web_of_Mis_Trust target=_blank>Comodo </a>, <a href=https://www.securelist.com/en/blog/208193107/More_on_DigiNotar target=_blank>Diginotar</a>, and Verisign Certificate Authority breaches forced discussion and action into the open, this time, this “dissolution of trust” discussion trigger seems to have been volunteered by <a href=http://blog.spiderlabs.com/2012/02/clarifying-the-trustwave-ca-policy-update.html target=_blank>Trustwave's policy clarification</a>, and followup discussions on <a href=https://bugzilla.mozilla.org/show_bug.cgi?id=724929 target=_blank>Mozilla's bugzilla tracking</a> and <a href=https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/ehwhvERfjLk/discussion target=_blank>mozilla.dev.security.policy </a>. </P> <p class=c><img src="images/pictures/klblog/208193387.PNG" border="1" alt="" title=""></p> <P> The issue at hand is the willful issuance of subordinate CAs from trusted roots for 'managing encrypted traffic', used for MitM eavesdropping, or wiretapping, of SSL/TLS encrypted communications. In other words, individuals attempting to communicate over twitter, gmail, facebook, their banking website, and other sensitive sites with their browser may have their secure communications unknowingly sniffed - even their browser or applications are fooled. An active marketplace of <a href=http://www.wired.com/threatlevel/2010/03/packet-forensics/ target=_blank> hardware devices </a> has been developed and built up around tapping these communications. In certain lawful situations, this may be argued as legitimate, as with certain known DLP solutions within corporations. But even then, there are other ways for corporate organizations to implement DLP. Why even have CA's if their trust is so easily co-opted? And the arbitrary issuance of these certificates without proper oversight or auditing in light of browser (and other software implemented in many servers and on desktops, like <a href= http://www.mozilla.org/projects/security/pki/nss/ target=_blank>NSS </a>) vendor policies is at the heart of the matter. Should browser, OS and server software vendors continue to extend trust to these Certificate Authorities when the CA’s activities conflict with the software vendors’ CA policies? </P>
Source: When Certificate Authority Business Models and Vendor Certificate Policies Clash (http://www.securelist.com/en/blog/208193386/When_Certificate_Authority_Business_Models_and_Vendor_Certificate_Policies_Clash)