Hacker News Reader

Comment by tveita | Hacker News Reader

This is a PDF attached to this issue, requesting blacklisting of the Superfish certificate:

https://bugzilla.mozilla.org/show_bug.cgi?id=1134506

I'm somewhat puzzled by the single certificate. Couldn't they have generated a new signing request and self-signed on each machine - at least ensuring that each customer has a unique cert for their proxy?

These guys aren't the brightest bulbs out there. You could even have it switch certificates on every reboot... or not do this in the first place. ;-)

> or not to do this in the first place.

Are there other options besides installing my own root certificate?

Assuming I want to write software that legitimately MITMs all HTTP and HTTPS traffic (parental control, ad blocker, anti-virus scan for webpages...). I want it to be browser independent and work with browsers that don't support extensions.

Well, it's basically impossible in some cases to MITM while showing the same certificate without re-building a browser. So your best bet would be to modify existing browsers. That said, if content modification isn't required -- and all you want to do is snoop on SSL, you can use SSLKEYLOGFILE in NSS-based browsers like Firefox and Chrome. If legitimate, I'd prefer going the extension route: people want you in their browser, so you can walk them through whatever it takes to install you, or provide pre-made profiles with you enabled. The point of encryption is to avoid spying and while most users (as evidenced here) don't actually check that the HTTPS website certificate is what it claims to be, pretending to be the same site is about all you can do to modify content and MITM. I'd also point out that the problem here isn't so much that they're MITMing as that they're doing it really, really poorly. Of course, any backdoor could be used by others -- even your SSLKEYLOGFILE. ;-)

More so I haven't heard very convincing reasons for MiTM even in other settings, and certainly in this case that they choose not to be deployed as an add-on - has to do with avoiding detection and removal, which is malicious - and that's not only conjecture, they actually market themselves that way in places:

Komodia’s Watchdog

The Kernel protection watchdog is used to protect Komodia’s Redirector files from being deleted/modified, lsp from being uninstalled and also protects the main process will not be stopped.

It's fine to proxy HTTPS.

But when you do so, you assume big responsibilities. You have to do all the stuff the browser does, and even lots of security people, if you sat them down and told them to write everything a browser does, would probably forget a few important things. (The browser security folks are exceptions.)

The top post on this page ('patcheudor) is from a researcher who reports that Superfish wasn't doing proper validation of certs, meaning we didn't even need to extract the private key from the binary to forge www.paypal.com.

If I spun up a stupid fake cert for www.paypal.com last week, with no knowledge of Superfish whatsoever, someone from a Lenovo computer would not get certificate warnings.

The more people look at this, the worse it gets. It's a fractal of bad security.

From what I understand of Superfish, Mozilla (and other browser vendors) can't just blacklist the certificate. That would make all HTTPS connections error out. A message notifying users of the issue is all they can do.

On the other hand, this is making the news.

They definitely can blacklist the certificate.

They have the choice of having HTTPS effectively useless (by leaving the certificate there), or making HTTPS not work (by removing it, thus prompting action from the user to fix it -- perhaps by calling their tech savvy nephew).

Browser vendors should (and usually do) err on the side of security.

Or the users just switch to a browser that works. IE or Chrome :(

Most Firefox users switched away from those (or didn't switch to them) because it works better for them - including security wise. I suspect that won't be their first course of action.

One way would be to bypass the proxy if it's detected as a Superfish proxy by its certificate, but somehow I feel like this isn't a problem the browser vendors should be doing extra workarounds for (and giving precedence to "if we don't like your proxy we'll ignore it" isn't a great idea either.)

It doesn't appear to be implemented as a user visible proxy, it modifies the network stack. From:

https://twitter.com/matthew_d_green/status/56843703790644428...

Probably not a proxy; probably low-level socket interception in Windows.

So there isn't much the browsers can do to help the user.

At least the technical side of Lenovo's response is all the way to "We are writing a program to remove the certificates", which is probably the thing that is going to impact the most people.

That's not their problem. It's Lenovo who'll be getting the support calls for their defective, sorry, "enhanced" product

If the user installs a Firefox update and then all their HTTPS connections stop working, most users will blame Firefox unless the error messages are very specific about Lenovo's involvement, which simple blacklisting won't do. Users who follow technical news and understand the problem will already have removed the certificate manually (and removed the proxy).

I doubt it. Most non-techie users will probably not get around to installing another browser, so seeing that neither bank nor gmail nor facebook works, they'll blame their ISP.

But most people already have IE installed!

Isn't this the sort of thing that Microsoft should be removing with the malicious software removal tool as well?

Reply on news.ycombinator.com