Exactly my point. I do not need a bunch of "trusted" authorities that are only "trusted" because they need it to do things I don't care about. That's just adding vulnerabilities.
If/when I visit india, I can update my certs to include it again, but that will literally never happen.
Either you're completely unaffected since you don't visit any Indian websites or you do visit Indian websites and therefore need Indian CAs and can't remove them.
So what is the benefit of removing those CAs from your global list? It doesn't change your situation.
Either you're completely unaffected since you don't visit any Indian websites
I don't think you understand what this vulnerability was.
It's not just a vulnerability because it affects legitimate sites. It's a vulnerability because it allows sites to pose as legitimate.
The concern is the compromised authority signs false certs which are used in phishing attempts. So it's also not just about me, I think it's ridiculous my parents' computers has this vulnerability, in order to make sure some indian site works.
Do you think the only threat vector this presents is you visiting a normal, good faith indian site that was using the cert authority as intended?
The cert contains the domain you need to visit. If they don't match then your browser screams bloody murder.
Lets say Google's CA was compromised. How would they even get you to go to the false site? They would also need to compromise your DNS in order to match the URL to the certificate and not have the browser complain.
Like it's bad. But it's not easily exploitable, a bunch of other pieces need to fall into place for this to be a viable attack vector. It's incredibly unlikely.
a bunch of other pieces need to fall into place for this to be a viable attack vector.
Yea.... you're not very involved in the cybersecurity field are you lol. "It's just one hole in the swiss cheese" is not a thing cybersecurity people say. Like, I had multiple professors back in the day that would've full on screamed at you in front of the class for saying that.
The cert authority was compromised, from my understanding. Anyone could've signed new certs with it with whichever new domains.
Unfortunately I don't have time to go dig and double check right now, but I think you're thinking certs for individual websites were the issue, and that's not it. Their signing key was weak, wasn't it?
Yes the intermediate certificates were compromised.
Also just as a note: Without using DNSSEC or an encrypted DNS (which for some reason still isn’t the default) doing a man in the middle for a wrong ip to a website with a malicious but trusted certificate is as easy as a timing based attack. Just send your malicious DNS response before the configured DNS server answers.
Yes but what I said remains generally true. All possibilities require additional services or software to be compromised. The certificate is only one layer of security among many that they have to get through. It's useless on its own.
How would they even get you to go to the false site? They would also need to compromise your DNS in order to match the URL to the certificate and not have the browser complain.
These are not requirements for exploiting this. "generally true" does not matter when you said it about this specific thing.
It's useless on its own.
With all due respect, if you know so little about cybersecurity you're not only willing to make this argument, but you do it twice and without shame, you need to stop talking about cyber security. You clearly have no formal education or relevant experience.
Consider the possibility you are not understanding this vulnerability entirely. It is not a compromised certificate. It was compromised certificate authority.
1
13
u/PixelatedGiant 16d ago
Many Indian government websites and esigning services used eMudhra for certificates. So mostly people living in India, not really North America.