Hacker News Reader

Comment by pilif | Hacker News Reader

Just revoking the intermediates is not enough. This tells the main culprits that it's ok to issue intermediates to do whatever and then deny responsibility as it gets detected.

The only possible course of action is to hold the root responsible and to remove them from the trust store.

The CA system is fragile enough as it is and only the prospects of immediately going out of business can be any deterrent for CAs not to start doing shady stuff.

Yes. Revoking the root is annoying for customers of that root, but I'm sure other CAs will gladly offer a free or really cheap replacement program. And if the affected root is REALLY big, then just pre-announce the revocation for a year or two. Just like what Google is doing with the sha1 certs.

View on HN

I have marked CNNIC root cert untrusted on all of systems I can control. It bothers me sometimes when some providers with "good" reputation uses them, like azure china. I had to manually add the server certificate to trusted list, just to manage my vms. Otherwise, I barely notice the issue.

It looks that even CNNIC certs themselves weren't widely deployed, correct me if I'm wrong, most of Chinese sites who wants to employ TLS doesn't do it right, for example, 12306 has its own root and some sites I use daily has a self-signed CA with random input in all of the fields.

If you think the company that has agreed to collaborate with a Chinese company to make a different version of Skype (Tom-Skype), for the sole purpose of letting the Chinese government spy on Chinese citizens' communications in real-time, can be "trusted" to not have backdoored cloud services in China, then I have a bridge to sell you.

Microsoft has proven again and again that it's willing to make any concessions to the Chinese government if there's the slightest chance of them making an extra percent market share in China. We saw that when Google was hacked by the Chinese government, too. Microsoft was more than happy to agree to all the censorship policies Google didn't, because it meant that maybe possibly that would earn them some market share in China, after Google would be gone - it didn't anyway. Baidu took all that difference Google lost.

To be fair Tom-Skype predates Microsoft's buyout of Skype.

This isn't just about earning market share in China. Just about any organization that operates in China (or hopes to) has a vested interest in, e.g., having reliable email access there. If your company uses Google products for email, etc., then these days you'll have some real challenges making them work for folks over there. Microsoft can capture a lot of American business that way. (Concrete fears about employees losing crucial access tend to outweigh philosophical arguments about government surveillance when folks sit down to make these decisions.)

Reply on news.ycombinator.com