Hacker News Reader

Comment by DanielDent | Hacker News Reader

While I appreciate the intent of the okTurtles folks, I think their reasoning about Google Chrome is flawed.

If I, as the user, want to override HPKP, it should be easy for me to do so. Perhaps, for instance, I'd like to MITM my own traffic for debugging purposes, or to get an idea of what data an app is transmitting.

Let's imagine for a moment that Google modifies Chrome the way the okTurtles people propose. Nothing stops Dell from writing a kernel patch which detects that code path and alters the functionality at runtime.

If you own the system, you can make it do whatever you want. And Dell starts out owning the system here.

View on HN

> I, as the user, want to override HPKP, it should be easy for me to do so.

Absolutely. For debugging purposes, browsers should have a mechanism where you can purposefully use your own local certificate, with a big unremovable warning at the top telling you that. It should not, on the other hand, ever look like a valid secure site.

No legitimate reason exists for a browser to silently show a site as secure that uses certificate pinning and doesn't serve the pinned certificate. Ever. For debugging purposes, you don't need it to work silently.

And if someone started intentionally compromising browsers to make such warnings go away, we'd have a clearer indication that they'd progressed past ignorance into malice.

I've heard that some corporate networks do this to enable filtering and monitor employee internet usage. I could see that being a somewhat legitimate use case.

So you don't think that the corporate employees have the right to know then their company is doing MITM to monitor their HTTPS traffic?

I guess if you're using a company's computer on that company's network, assume it's their best interest to monitor some of the stuff.

They can monitor, that's fine, and the correct/ethical thing would be to inform the employees about it and show them a little thing in Chrome to indicate they're being monitored.

Informed consent, in other words.

pdkl95 also makes excellent point about the current default behavior being the problem: https://news.ycombinator.com/item?id=10630375

A corporate network (or any other end user) should have no trouble enabling some sort of explicit override option. Having the ability to override certs is fine; the problem is that it's default behavior.

Dell would (hopefully) be a lot more reluctant to ship one of these certs and show specific intentions by changing settings to allow this kind of override.

We could argue over whether that qualifies as "legitimate", but in any case that doesn't require doing it silently and showing sites as secure. Browsing on such a network should show persistent warnings about every site whose traffic appears potentially intercepted. You can then knowingly continue browsing on that network if you consider it legitimate.

Palo Alto Networks firewalls do exactly that. It was one of their big differentiating feature; this is the main reason companies buy them.

Personally I agree with you, but PANW has 15.62 billion reasons to disagree with us. I suspect Google's position is to placate companies like PANW and their customers.

I eagerly await the point where we finally start treating the generation of MITM certificates by any CA as immediate grounds for permanent revocation by all browsers.

Articles like this are some of the funniest posts on Old New Thing, eg [1]. There's no alternative to trusting everyone you allowed to install software on your machine or who has admin/root access.

[1] http://blogs.msdn.com/b/oldnewthing/archive/2014/07/03/10539...

You seriously don't see any difference between 1) Dell installing a cert that applies broadly with plausible deniability (the current situation), and 2) Dell installing a similar cert and explicitly overriding some sort of per-domain debug setting?

Yes, Dell could do anything they want, but the latter situation clearly establishes mens rea[1].

https://en.wikipedia.org/wiki/Mens_rea

The article addresses this explicitly. The point is to reduce the attack surface and limit the damage that is caused by these sorts of 'mistakes'.

If Dell writes a kernel patch they will fail Windows accreditation and not be able to ship Windows.

I think Chrome should treat user CAs as untrusted and require a click wrap before proceeding.

Reply on news.ycombinator.com