https://groups.google.com/a/mozilla.org/g/dev-security-polic...?
https://groups.google.com/g/mozilla.dev.security.policy/c/Me...
Mozilla: There are some misissued certificates. Revoke it.
Japan: Nah, you can trust us. We are government. It will expire soon anyway.
Mozilla: That's not an acceptable response. We do not trust you. Have a good day.
Japan: Wait. We will revoke. Just kidding. Please trust us.
Mozilla: Too late.
Lol
oh lawd.....
Have you dealt with public sector before? That's essentially status quo across the board.
Surveillance:
https://theintercept.com/2018/05/19/japan-dfs-surveillance-a...
https://www.nytimes.com/2022/02/02/business/japan-elderly-su...
https://giswatch.org/en/country-report/communications-survei...
Cybersecurity:
legal framework - https://iclg.com/practice-areas/cybersecurity-laws-and-regul...
policy - https://thediplomat.com/2022/09/japan-needs-a-cyber-ministry...
Writing small novels in response to simple questions ("who owns the company", "in what countries are you a legal entity") was never going to work with the CA forum. It might work in corporate contexts where nobody has the time to read emails, but it only seems to have raised suspicions more in this mailing list.
When Serge Egelman came up with a plausible defence for why both the allegations and the responses to them could be true at the same time (the representative and the current employees actually being victims of a company set up in bad faith and left behind by government/bad actors) she becomes extremely defensive. The thinly veiled accusation of sexism definitely doesn't help their case at the very least.
I find this a very strange response by a CA representative, or a CA in general. If the company is actually the victim of something bad, it can definitely learn a thing or two about clear communication. I do like the way the paragraphs of her email was structured (in response to, prior context, actual answer), though.
Imho, Matthew Hardeman makes the best point in the entire thread:
"Something that yet again concerns me in this discussion is an issue that I touched on previously in the discussions related to Dark Matter: that unless the program is requiring transparency as to corporate governance and management/operations authority, and establishing a basis for trust and accountability at the level of those individuals empowered by participation in the program, I believe we will continue to see these subjective trust decisions again and again. [...]
I once again humbly submit that I believe the executive and operational management teams of the CAs in the programs should be required to submit to the root program personal attestations as to their position and authority along with a commitment to inform the program promptly if anything has altered or replaced their authority. I believe there should be an explicit understanding that failures by such person(s) would be held against such person(s) individually and would bar their involvement at other trusted CAs for an indefinite period.
I yet again advocate for a measurable standard for holding CAs accountable at the executive management / operations level with costs taxed upon those persons who have made commitments to the program and failed to honor them.
It seems likely to me that one or more presently included CA could be reasonably described as owned by Blackrock or Vanguard. [...]"
That would upset far to many balances/be way too hard however.
I honestly feel like his explanation is likely, but she was in complete denial knowing how she's effectively left holding the bag.
Is she and the company now in a better place having everything revoked but still standing by her assertions? or would it have been better accepting the possibility of what happened and instead tried to work with everyone involved?
Serge was giving her rope to pull herself out of this hole and she just seemed to want to wrap it around her own neck instead...
>Unknown until recently by any employee officers of TrustCor we and Measurement Systems S de RL had in common a group of investors who represented funds (groups of companies and other funds), not individuals. Even though we shared a common group of investment funds, we have always operated our business independently of any other company and have exclusion provisions in place to protect the CA business from having access-to or being controlled by or influenced from any third-party, investors, equity-holders, or anyone other than TrustCor’s CA Approving Officials and employees. To the best of our knowledge (and our focused investigation) there is not and has never been shared ownership with any defense company or any USA company. This common group of investors with Measurement Systems S de RL. had already dissolved mid 2021, before these recent claims were publicized, meaning as a natural course of business and not as a reaction to any claims or adverse events. In 2021 TrustCor ownership was transferred from the initial investors/founders to the employees of TrustCor. The legal process has been very step-by-step and very slow, especially due to the protracted treatment and recent death of one key founder, Ian Abramowitz. Nonetheless, it is underway and irreversible, and the common investment vehicle was dissolved over a year ago.
I'm not sure how that isn't a straightforward answer to a somewhat complicated situation in transition.
Don't fault a person for giving a comprehensive answer when you ask an important but complicated question.
If people knee-jerk from that, that's a listener problem, not an answerer problem.
As a CA, even a hint of malfeasance should require in depth transparent answers. Not this legal BS peddling.
Because from what I read, I could see a decent chunk of them getting tossed out at the end of the star chamber as well.
And then we'd be left with a more centralized system with a few large players.
If corporate structure, ownership, and governance is important (it is!), then there should be standard processes, not ad hoc lines of interrogation whenever a CA happens to be noticed.
The CA system is already designed like a centralized system where the operators (CAs) have full privileges. Adding another CA just means adding another potentially malicious or vulnerable single point of failure that could bring down the whole system.
Kathleen obfuscates it a bit by putting the name of the director in a footnote, but here it is put together:
> The same individual was responsible for the day to day operation of both TrustCor’s CA business and MsgSafe. They are listed on TrustCor’s website as the VP of TrustCor’s CA operations and the Director of Operations for MsgSafe. [2]
> ...
> [2] Rachel McPherson is listed as the Vice President of Operations, having “access-to and control-over the CA and CA Business Operations” in a company document submitted privately by Rachel to Mozilla. Press releases on TrustCor’s website list Rachel McPherson as MsgSafe.io’s Director of Operations, e.g. https://web.archive.org/web/20221108224150/https://trustcor.....
It feels like all the people swayed by this have never worked for smallish shady clusters of companies or with them, and it shows.
1. Graduates 2007 with bachelors in media arts
2. Office admin 2007-2009
3. Volunteer coordinator at cancer foundation 2009-2013
4. VP of ops at trustcor 2013-now
That is ... an interesting career trajectory to be sure.
It looks like Trustcor was maybe founded in 2013, so maybe just the typical startup "here have a VP title" type thing, but yeah
> Based on that understanding (and again, please let me know if any of that is incorrect), I personally believe it's possible that Rachel may be a victim here, if she really is the primary TrustCor shareholder (e.g., maybe the company was given to employees, after it was no longer useful). If TrustCor's private keys were compromised at its founding or before (e.g., so that Packet Forensics could sell TLS-interception boxes), the company itself would have little continued value, so long as it passed its audits (and remained trusted by browsers and operating systems). It's therefore possible that Rachel had no awareness of this, and as a result is in the denial phase of realizing that she's the victim of a scam. This is not a statement of fact, I'm just offering it as a possibility.
(Rachel vehemently denied this)
Are root cert keys not rotated?
For example, the DigiCert Global Root CA in HN's cert chain is valid from 2006 to 2031.
They are but by their nature as core components of OS and devices they have to be long-lived, because they “bound” the lifetime of their sub-certs.
So root-certificates usually have an expiry of a decade or two, intermediate certs a few years (about 5), and then leaf certificate lifespans have been cut down drastically: used to be you could get a 10 years cert, then the CABF cut that down to 5, then 3, then 2, and I think now it’s a year (plus a one month grace period, so 13 months), and some registrars issue much shorter certs than that, notably Let’s Encrypt which issues 90 days certificates and basically requires automation.
Which massively reduces expired cert problems. If you only need to do it once a >=year you do it manually and at some point someone forgets / the guy with the calendar reminder leaves...
If you have to do it every 2-3 months you automate it with alerts for when it fails.
In effect, no. Such a "rotation" requires all clients trust the new root. Your PC probably gets software updates every week or every month, maybe your phone gets one a month or per quarter (until support runs out). But how about your smart TV ? Car ? Internet-connected Doorbell ? That IP phone you disconnected last winter and forgot to re-install ?
Big CAs tend to ship new roots periodically, in addition to their existing roots, so as to begin gradually phasing over, over a period of several years. So e.g. HugeCA mint a new key in 2001, the major trust stores decide to trust it in 2002-2003. In 2005 HugeCA offer certificates from the new root to customers who prefer the new root and understand the risk. Unfortunately these customers see high failure rates, e.g. the all-in-one printer scanners from a big name company they used in their offices have firmware last updated in 1998. In 2008 HugeCA confirm the big name company printer/scanner firmware update is complete and begin in 2009 selling these certs more widely, there are a few hiccups, they don't work in Windows ME which one customer insists is "the latest version". But maybe by 2011 HugeCA can announce retirement of the old CA root with a retirement date of say 2015.
Some older clients unfortunately can get into a state where they distrust root #1 (e.g. because it is old) but they know it exists, and so even though they trust root #2 they can see this alternate path via the intermediate to root #1 and reject the whole mess. People shouldn't write software which does this, but they did.
Thus positively confirming that she was in the denial phase.
Also, they tend to be overly verbose but with no real substance as to waste everybody's time so it might look it was GPT-3 instead.
Anyway I'm not claiming it _actually_ was GPT-3, rather that it similarly lacks substance. It's instead creating an illusion of content with words.
That is not incriminating, that is standard practice: say the least amount possible unless compelled by the law, because even benign things could later be used against you.
Corporate legal counsel often doesn't share the reasoning behind their advice for this very reason.
> MsgSafe offered this app (with the malware SDK) to the public via the Google Play store as part of a public beta, where it was free for anyone to download up until earlier this year. MsgSafe publicized its mobile app on social media. As of this writing, MsgSafe's website still links to the Google Play store (though the app was removed earlier this year):
>> This is not correct. The MsgSafe.io beta app was actually a testing beta, which could not be accessed by anyone via the Google Play store. The only way the app was accessible was to our employees or via a unique social media link MsgSafe.io sent out over 3 years ago, and that link only worked for a limited time. Using that unique social media link, we can tell that less than 1/10th of 1% of MsgSafe.io's users would have had the opportunity to download to test the app, and the actual number that installed it was much lower. Also, your statement about the MsgSafe.io website still linking to the Google play store is completely false. Did you even check this before making this post? In the screen-shot you shared, the icon labeled "Download on Google Play" does not direct you to the Google play store, it directs you to https://www.msgsafe.io/android which actually takes you to a 404 page on the MsgSafe.io website - it never leaves the MsgSafe.io website. Had you hovered over this link you would have seen this. Of course we're not proud of an outdated website and this should be updated, but that doesn’t make your false claim true.
As of November 10th 2022 it still redirected, the IA Wayback Machine cached it: http://web.archive.org/web/20220701000000*/https://www.msgsa... (Direct link to Nov 10th http://web.archive.org/web/20221110070138/https://www.msgsaf...).
And as for ownership, wouldn't knowing the person you're talking to is the largest shareholder enhance their credibility to negotiate and discuss issues with you?
Still, as pointed out in the email thread, a CA is also evaluated on how trustworthy they are in a broader sense than the baseline requirements. Uncertainty and doubt is great at making people dizzy and muddying the waters, but compared to other CAs who respond with openness and transparency, the contrast is striking.
What starts as a relatively boring thread morphs into something else as it goes on.
I have to say though, I did not read all the responses from the accused, as that is essentially impossible.
An example is the bit of boilerplate that kept repeating how the app was BETA and could only have gone to a small percentage of people (not relevant), and it wasn’t ever “published” (which is a lie) and how sdks get updated all the time and it is not our place to speculate about how that might have happened. This is an extremely abridged version of this “argument” that she trotted out repeatedly just trying to tire people out. There are many other examples of this type tactic in her responses. The overall effect is that she very much appears to be arguing in bad faith.
Those were clear questions.
The other half of her text was her answering questions that were never asked.
At no point did she answer the questions that were asked.
She was repeatedly asked about the corporate structure and shared investors. The answers reached from claims that it'd be too much content to summarize in this forum, claims that lawywers advised against it, claims that answering truthfully would lead to tax obligations, to claims that she doesn't know and would have to speculate.
Instead, she spent lots of time explaining the remote-work arrangement in Canada (irrelevant), the upstream networks of their Phoenix datacenter (irrelevant) or the tax situation of employees/contractors working for their company (also irrelevant).
Or not being a company who derives the majority its revenue from the company above?
This whole controversy is like a flock of lambs asking a pride of lions to stop some mosquitoes from biting them.
To be clear: if you don't know the answer, it's not evasive to say "I cannot answer that" or "I don't know the answer" or "giving an answer would be speculation on my part".
And it seems like Mozilla's concern is: "Is it in Mozilla's users interest to have this CA in their trust store?", which is probably the only sane way to run a trust root program. That means any concerns about the well-being of the company which runs the CA must be ignored.
I read it all, it was extremely repetitive with little substance. When she did say something new/interesting it was cagey and often not direct.
> She may be partly to blame for that, but people asked for answers and didn’t read them when given!
Disagree. They read it and ignored the fluff that said nothing of value.
> I don’t think TrustCor’s situation is something to joke or gloat about. Someone’s entire business just got ruined because of, if Rachel is to be believed, something wholly unrelated to operation of the CA and arguably entirely out of their control.
And that's the thing, she isn't to be believed, I sure as heck don't believe her. I posted in another comment a clear lie about linking to the android app (not to mention the constant "It was never in released" BS is so mealy mouthed it isn't even funny). The same parent company owned the CA and this msgsafe, it also seems clear there was a little more to the "Measurement Systems" relationship than Rachel would admit. Sorry, that's way too many coincidences. The final nail in the coffin is the ties (even if they are fragile) to Packet Forensics which you wouldn't want in the same breath as CA yet the connections are hard to ignore given everything else Rachel said (or didn't say).
I also don't for a second trust all the:
> I was reminded by some of you this is a big public forum with non-CA-operators and non-browser/platform-developers present, and that participants have a lot of interest in these topics but not always the same level of experience or familiarity with the CA operations and root CA program guidelines or technical knowhow as the intended audience. Therefore let me begin by saying THANK YOU to my fellow CA/B Forum members and members of the larger community for reminding me of that, and separately thank you for those of you that have sent very nice and encouraging, supportive emails (you know who you are)
Yeah, my girlfriend goes to another school, you've never heard of it... Okkkkkaaayyy.
Then look at their "Why are you persecuting us!" line about other CA's, which just screams guilty. On top of all of that their msgsafe system appears to be a fraud (it's not E2EE despite their claims) so if they are acting that way with one arm of their parent company why should we trust the CA (who's auditor looks questionable and also the fact they've used the same one every year)?
The phrase you are really reaching for here, well-known to every truly ancient netizen, is "the lurkers support me in email".
Some unhinged usenetter (but i repeat myself) traced its origins to the mid '90s: https://groups.google.com/g/soc.singles.moderated/c/UTopjdXT...
And, as mentioned in that poast, there is a song: http://www.jowaltonbooks.com/poetry/whimsy/the-lurkers-suppo...
* TrustCor owns MsgSafe.io, which somehow incorporated an unobfuscated and customized version of the malware. She kept trying to distance the CA from MsgSafe, but as Kathleen points out that's disingenuous given that Rachel herself is both VP of Operations of the CA and Director of Operations of MsgSafe.
* TrustCor was, until recently, owned by the same holding company that also owned Measurement Systems, which produced the malware incorporated by MsgSafe's app.
If these things were not true, they should have been pretty easy to debunk. If they are true, I agree with Mozilla that they provide sufficient reason to revoke the CA. The ties to the malware are just too close to risk leaving them trusted.