Kudos to Google which made the right, prompt and decisive move to protect the security and authenticity of the entire internet ecosystem.
The setup of the security certificates like HTTPS (Hyper Text Transfer Protocol Secure – a more secure version of the original HTTP protocol and usually used to secure e-commerce transactions like online banking, email applications and e-commerce checkout areas) have been based on a system of trust placed on the issuers of those certificates. It takes just one breach to break down the entire system and China….. well, you know the rest of the story – Check out the video clip and TechDirt article below.
Google Completely Cuts Off Chinese Government’s Certificate Authority, CNNIC
from the wow dept
As you may have heard, last week, Google warned about an unauthorized HTTPS certificate being issued via CNNIC (China Internet Network Information Center — which basically manages the Chinese internet, handling domain registration, security certificates and more). CNNIC blamed an Egyptian firm MCS Holdings, saying it had allowed MCS to issue security certificates for domains it had registered, but MCS had abused that power to issue bogus certificates.
Late on Wednesday, Google added a somewhat surprising update to its blog post about the matter, announcing that it was cutting off CNNIC certificates going forward:
As a result of a joint investigation of the events surrounding this incident by Google and CNNIC, we have decided that the CNNIC Root and EV CAs will no longer be recognized in Google products. This will take effect in a future Chrome update. To assist customers affected by this decision, for a limited time we will allow CNNIC’s existing certificates to continue to be marked as trusted in Chrome, through the use of a publicly disclosed whitelist. While neither we nor CNNIC believe any further unauthorized digital certificates have been issued, nor do we believe the misissued certificates were used outside the limited scope of MCS Holdings’ test network, CNNIC will be working to prevent any future incidents. CNNIC will implement Certificate Transparency for all of their certificates prior to any request for reinclusion. We applaud CNNIC on their proactive steps, and welcome them to reapply once suitable technical and procedural controls are in place.
This is a pretty big deal, but the right move for Google to make. It’s well known that the whole setup of security certificates is based on how much you trust the issuers of the certificates. If you can’t trust the certificate authorities the whole system breaks down. This has long been a problem that is going to require a very different security model in the future. But, while we still have that system, it’s of absolute importance that any breach of trust needs to be dealt with severely.