Hacker News Reader

Comment by elbigbad | Hacker News Reader

Can someone explain root certificates to me and why this is an issue? I know they sign certificates with a private key at a high level, but don't get the implications of that generally.

View on HN

Think of trust relationships as a forest of trees. Initial seeds of these trees are root certificates installed by browser vendors(Chrome: Google, Safari: Apple, Firefox: Mozilla, etc). Whenever you open an https site, if your browser checks whether to trust that https site. So, your browser trusts it if that site's public key is signed by the one of roots shipped/installed by the browser vendor.

You can also add your own cert to the root certs list of any of the browser, then any site's key's signed by your cert is gonna be trusted. Next time, check whenever your browser says "Don't trust this site", then explore the key chain.

Anyone who installed this audio driver could have all their https traffic intercepted by Savitech.

Does this mean savitech needs to hypothetically set up some mitm attack somewhere and wait for you to send traffic, then they can decrypt and read, or does it mean that they can do that direct from your computer by virtue of that root certificate?

They would need to MITM you. But take into account that it doesn't need to be Savitech. If Savitech was compromised, an attacker could get access to their private key.

In a sense, your security becomes dependent on the security of Savitech. I imagine their private key is not as securely stored as a real CA would store theirs. (e.g. with Superfish, Lenovo included the private key on all laptops, for anyone to grab[1])

[1] https://en.wikipedia.org/wiki/Superfish#Lenovo_security_inci...

They would need to MITM you somewhere, but that could probably happen in their audio driver that's already installed and running on the target machine.

Reply on news.ycombinator.com