Hacker News Reader

Comment by cm2187 | Hacker News Reader

I thought that Chrome checks and reports that google.com certificate is a google issued certificate. How did this mitm attack not pop up massive warnings in chrome?

View on HN

Chrome ignores Trusted Root Certificates when checking certificate pinning.

But doesn't that defeat the purpose? If a trusted Chinese certificate authority issues some certificate on google.com for China to perform MITM attack, and Chrome ignores anything signed by a valid root certificate, it will never report this attack. I thought the point of certificate pinning is precisely that only a single authority can sign a certificate for a website.

This situation is quite common in enterprise deployments [1], where HTTPS traffic is MITM-proxied through a central server to e.g. check for malicious content or other filtering.

If Chrome were to block unknown roots for pinned sites, these sites would become inaccessible because the MITM proxy is still active. That's certainly not desirable in a controlled enterprise environment, but the same would occur when blocking this 'Lenovo root'.

[1] http://it.slashdot.org/story/14/03/05/1724237/ask-slashdot-d...

No, the purpose of pinning is to stop a compromised CA from issuing their own www.google.com cert.

If someone installs a CA, Chrome will trust it. There's not much way around this: if someone has the capability to install a CA on your computer, they'd have the capability to modify chrome.exe to force acceptance of it.

Also, sometimes MITM'ing is desired. I'm doing it right now with Firefox and BurpSuite.

I think the problem is rather giving a false sentiment of security to the unsuspecting user.

Chrome could display a notice reminding users that it's an executable that can be compromised by other programs. But those other programs could also delete that notice.

I was thinking more something like an amber icon instead of green, which shows this connection is somewhat secure but there are problems detected.

More precisely, Chrome doesn't enforce certificate pinning if the certificate is signed by an unknown root (like one installed by your system administrator, or apparently your laptop manufacturer).

https://code.google.com/p/chromium/codesearch#chromium/src/n...

Reply on news.ycombinator.com