4

This is a question derived from several others, and I can not comment on those, so it is not duplicated, please read:

In some related questions some users comment that:

  1. "They wouldn't necessarily have to present untrusted certificates. Suborning an existing Root CA is trivial; as they are businesses like any other. Some countries like Spain, France, China, Japan, Taiwan and Turkey already have their government root ca installed on your computer. A regime could easy require all computers sold or maintained in their country to install their government's root ca."

Besides that, there is an issue with:

  1. "With another valid TLS leaf certificate the CA flag can be bypassed and that certificate used to sign a certificate for any site.

Chrome and Firefox are certainly vulnerable to this on unpatched systems (which is likely a lot of systems today)."

So, 3 questions:

  • From point 1), if you live in those countries, with "spain...etc", if there anyway to check that the CA you are using (in firefox for example or other) is the proper company , for example google/gmail? and not the goverment one?

  • From point 2) how do you we know that we have our browser/system not patched for that kind of bug?

  • In summary, from previous points WHERE and how should check my CA fingerprint from Gmail.

I have this:

enter image description here

I checked here.

Is this correct?

  • Chrome and Firefox don't use OpenSSL except Chrome on Android -- but updates for most Androids go via phone vendors and carriers and are mostly much too slow to have picked up an OpenSSL vuln that was introduced only a month ago. – dave_thompson_085 Jul 27 '15 at 20:19
4

From point 1), if you live in those countries, with "spain...etc", if there anyway to check that the CA you are using (in firefox for example or other) is the proper company , for example google/gmail? and not the government one?

You can check the certification path to find out which intermediary and root CAs signed the certificate that you are presented with from your browser.

From point 2) how do you we know that we have our browser/system not patched for that kind of bug?

Generally only by checking online vulnerability databases such as this one or vendor bug lists to check whether a particular security issue has been identified and patched.

Is this correct?

You can check online SSL fingerprints such as this one on GRC. The page notes that Google and Apple cannot be checked in this way:

But companies with a massive and widely distributed web presence, such as Amazon or Google, may deploy many different security certificates across their many globally distributed servers and web sites. Multiple certificates may be easier for them to obtain and manage, and their security is not reduced. But it does mean that not every user of their servers (like you and this GRC page) would necessarily obtain the same security certificate.

This means that a simple comparison of certificate fingerprints could erroneously lead people wishing to test these huge websites to conclude that their connections were being intercepted, when they have simply received a different valid certificate than the one received and shown by this web page.

The best solution is to test smaller sites that are known to be using single certificates, or sites using the completely unspoofable extended validation (EV) certificates with an EV-honoring web browser such as Firefox or Chrome (but not Internet Explorer, which doesn't properly verify EV certificates).

Mandatory attrition link.

Note that if you were the subject of a targeted attack, a Man In The Middle could alter the GRC page to show you the certificate fingerprints that she was spoofing. Unlikely, but important to include this information here because it is easily technically possible. You could check the GRC page via TOR or via another connection (e.g. via 3/4G) in order to verify your main connection has not been MITM'd. This can also be applied in order to verify the certificate chain in most cases - but as noted, Google and Apple may have different CAs depending on which server your connection hits.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.