Hacker News Reader

Comment by mattkrea | Hacker News Reader

The bigger takeaway from this is with a system like this (fully managed by Windows Updates).. how can you remove certificates you don't trust?

Latest documentation for this seems to be for IE 5. I sure as hell like to run dkpkg-reconfigure ca-certificates every once in a while after some roots get compromised and don't trust Microsoft to be on the ball.

View on HN

It can be added to the disallowed certificate store, which takes precedence over any trusted stores.

For example, using the root discussed in the article:

1. Download the root cert from http://ctldl.windowsupdate.com/msdownload/update/v3/static/t... (or save it from the browser's certificate viewer)

2. Open certmgr and import it into 'Untrusted Certificates'.

(This just adds it for the current user's store. Could also import into the computer store by running mmc, adding the Certificates snap-in, and specifying 'Computer account' as the target.)

3. Restart browser. Go to https://certplusrootcag1-test.opentrust.com/ - it should say the certificate is revoked.

This only works for browsers like IE and Chrome, that use the Windows certificate store. Firefox has its own so would have to be done separately.

Thanks! While I still find this kind of backwards at least something like this exists.

Hmm, I think it's a very elegant design, probably built to precisely address the problem you asked about. Update server manages whitelist, user/admin manages blacklist, which wins. Nice!

I prefer the situation on Linux where I don't have the certificate at all rather than getting the certificate and having to mark it untrusted.

Edit: I'm referring to configuring the package as ca-certificates is installed or via dpkg-reconfigure

Correct me if I'm wrong, but don't several distros come with pre-packaged root CAs?

I think the idea the parent is trying to express is that if the Linux distro (and OS X in this situation) comes with the root certificate trusted by default via ca_root_nss/ca-bundle or whatever the packager decides to name it they can disable it before even connecting to the internet, and if the certificate is not trusted by default then they don't need to worry about it magically getting trusted in the future outside of the simple fact of updating the root certificate store blindly without inspecting it.

Microsoft's approach means that the user would have to go find the certificate on the internet and blacklist it explicitly, which allows a small window where the computer is vulnerable to some kind of attack involving a certificate signed by the unwanted authority.

so does this mean in a year I can make use of my free upgrade and then install a nice prepackaged something that will kill it's capacity to spy on me?

That seems reasonable : CNNIC compromised themselves and were removed from Mozilla and Android root cert stores, Microsoft's root cert store still trusts CNNIC.

e-Guven as well

https://blog.mozilla.org/security/2015/04/27/removing-e-guve...

edit: e-Guven is being removed "due to insufficient and outdated audits" and not a compromise (Couldn't reply below).

e-Guven was never compromised, it just still uses outdated practices like issuing directly from the root and expires in 2017 anyway. I once even caught an 1024-bit DSA cert being issued from this root by mistake.

Reply on news.ycombinator.com