Firefox and Edge revoke Root Certificate Authority

brent

for Trustcor. https://www.itbrew.com/stories/2022/12/02/mozilla-microsoft-ditch-root-certificate-authority-under-cloud-of-suspicion
Interesting and weird story. Certainly riles the imagination w/ it's implications.
Snippets:
"Mozilla and Microsoft have removed root certificate authority (RCA) TrustCor from their respective Firefox and Edge browsers, under a cloud of suspicion over its reported ties to spyware firms and intel agencies. Both browsers will no longer accept new TrustCor certificates..

"The vetting process for an RCA to be in major web browsers is expensive and lengthy, because RCA status comes with the potential for abuse, like surveillance and traffic hijacking. Firefox’s approval process, for example, takes at least two years..

"...a number of concerning insights into TrustCor, including shared officers with a Panamanian spyware firm called Measurement Systems, which distributed an app software development kit (SDK) that secretly collected data on users. Measurement Systems is itself an affiliate of Packet Forensics, a firm that has pitched police on its ability to conduct man-in-the-middle attacks.."

I was thinking, as devil's advocate, that one software company shares an office floor with another software company, what's the big deal? Then the story got weirder. It's raining where I live and this is rainy reading for sure.

ReillyBrogan

brent I was thinking, as devil's advocate, that one software company shares an office floor with another software company, what's the big deal? Then the story got weirder. It's raining where I live and this is rainy reading for sure.

I haven't read the article but usually software companies don't just share offices like roommates. Usually it strongly implies that they are closely linked and share ownership/management. That alone is a huge red flag here.

tomscharbach

brent Good to know that Microsoft and Mozilla are on the ball. I imagine other browsers will soon follow. It will be interesting to see what Google/Chrome and Apple/Safari do.

brent

ReillyBrogan implies that they are closely linked and share ownership/management.

absolutely. wapo and itbrew didn't probe the office space thing more than that as I could tell...but the dots connect pretty well in this one.

brent

tomscharbach those 2 browsers made it at the end of the article with "we're aware of the situation" -type statements.

Staudey

tomscharbach Clint Wilson, who works for Apple, is also part of the email thread. But according to https://wiki.mozilla.org/CA/Policy_Participants he's "posting in a personal capacity, except where otherwise indicated. Posts and views do not necessarily represent the views of Apple, unless explicitly indicated."

edit: Nevermind, he actually explicitly writes on behalf of "the Apple Root Program" in his email. So they have officially voiced some concerns already (on Nov 12)

Staudey

The email thread is an absolute treat, and certainly makes Trustcor seem highly dubious and untrustworthy.
https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/WJXUELicBQAJ?
(Note: I only read through as much bullshit as I could stomach, back when it was posted on Hacker News the day before yesterday or so)

brent

Staudey delicious thread with the big browser tech pros in it, and a half hour later I'm as much as I can stomach. The CA experts have 10X the forensic evidence the Wapo and my source does....and when Trustcor rushes into the thread to do damage control and deny everything it makes it so. much. worse. what an ugly spectacle. i lose more hope every time I read these kind of revelations.