HTTPS is fundamentally insecure against MITM attacks by governments.
It is vanishingly unlikely --- on the level of "major diplomatic incident" --- that China (or any other government, including ours) has the key associated with Verisign's root CA certificate.
It is somewhat more likely (but still, I think, pretty unlikely) that one of the following could have happened:
* Your computer is controlled by an employer that installed a deliberately insecure certificate.
* Your computer is infected with malware that poisons the CA store in your browser.
The first scenario is just very unlikely. We work extensively on-site for Fortune 500 enterprises, in some of the highest-security environments in the world (and in some of the most idiosyncratic and crazy), and none of them require us to install bespoke certificates to access the Internet or their websites. Now, you have to find the one employer (or zero ISPs) that not only installed a custom root, but also gave the keys to China.
The second point is irrelevant. If your computer is infected with malware, there are worse things to be done to you than injecting bogus certificates.
It is almost the case that it's worth pruning out certs from your browser from untrustworthy CAs; unfortunately, the market for certificates has devolved to "who will give us a cert the cheapest". I wouldn't know which ones to kill. A year or so ago, pruning out untrustworthy CAs would have protected you from the MD5 problem.
From another perspective: I worked on the content filter for Parental Controls at Apple. My understanding is that every filtering proxy product with SSL support requires the installation of an insecure certificate. That, or they do a fairly rudimentary IP or reverse-DNS based filtering (which is the route we chose for Parental Controls) for secure connections.
These vendors certainly claim to have a lot of Fortune 500 clients.
Sure. I'll give you this.
> It is almost the case that it's worth pruning out certs from your browser from untrustworthy CAs;
This was my point. So you trust VeriSign, but do you trust the others (there are 125 in my list)?
Here's one:
Issuer: C=TW, O=Government Root Certification Authority
If you imply that there's a problem with the SSL/TLS/HTTPS model, I'm pushing back hard. There is a weird SSL stigma among web developers, and it's time to start beating it back. The alternatives are worse.
The funny thing is that x509 has the ability to limit signing to various CNs, so it's possible to limit signing powers, but no one seems to do it.
> The alternatives are worse.
Hardly. Some alternatives might be worse (plaintext everywhere, for instance). What I would like to see is a * .example.com signing cert being given to all domain owners when they buy a domain, signed by a single * .com authority (or .net or whatever the domain is). This would prove to the https client that the domain they are connecting to is really the domain owner. This is a basic level of trust that would be an option for everyone who owns a domain (without any stupid yearly charge for the certs).
Banks and other important sites could go above and beyond and buy certs that verify that their business is what they say it is, which is another trust level entirely (this already exists and can be seen when you go to paypal.com in firefox and get the green location bar thing).
I think that would be a much better alternative than our current system.
Google even references this in the press releases - most of the information gained was done through phishing.
Edit: CA operates based on trust. All it takes is for a single website to demonstrate this is going on for it to quickly become public knowledge. Now, if you where to target a specific user it might be possible to do this, but hacking their system is a much simpler approach to the same problem with more benefits.
For the long term I wonder if it's possible to close this hole by putting certs into DNS and using a single key to sign all of these DNS records. Is this part of the DNSSEC spec? (not at a computer and can't remember for sure if it is called DNSSEC; whatever the name of the next gen DNS is.)
The reality of DNSSEC is that it's creaky, somewhat broken, solves neither the PKI nor the DNS protection problem well, and --- because it is likely to pervasively screw up applications across the Internet --- unlikely ever to be deployed.
Either way, there's no magic bullet. If you concede root keys to China, you have to concede DNSSEC keys --- which are, if anything, more loosely held and more widely distributed than CA keys, which have never had a known breach.