Catch up on stories from the past week (and beyond) at the Slashdot story archive


Forgot your password?
Security Google The Internet

Chinese CA Issues Certificates To Impersonate Google 139

Trailrunner7 writes: Google security engineers, investigating fraudulent certificates issued for several of the company's domains, discovered that a Chinese certificate authority was using an intermediate CA, MCS Holdings, that issued the unauthorized Google certificates, and could have issued certificates for virtually any domain. Google's engineers were able to block the fraudulent certificates in the company's Chrome browser by pushing an update to the CRLset, which tracks revoked certificates. The company also alerted other browser vendors to the problem, which was discovered on March 20. Google contacted officials at CNNIC, the Chinese registrar who authorized the intermediate CA, and the officials said that they were working with MCS to issue certificates for domains that it registered. But, instead of simply doing that, and storing the private key for the registrar in a hardware security module, MCS put the key in a proxy device designed to intercept secure traffic.
This discussion has been archived. No new comments can be posted.

Chinese CA Issues Certificates To Impersonate Google

Comments Filter:
  • If we only knew what was really in that "partnership" agreement... Now we do!

  • by Virtucon ( 127420 ) on Tuesday March 24, 2015 @01:57PM (#49329153)

    When we all agree to the same rules.

    • by Anonymous Coward

      The beginning of the end... I expect this will end with other countries de-trusting chinese authorities and vice versa. China is obviously trying to man-in-the-middle their citizens TLS connections to google.

    • by Feral Nerd ( 3929873 ) on Tuesday March 24, 2015 @03:39PM (#49330277)

      The Web of trust only works ... When we all agree to the same rules.

      The CA system is broken.Trusting many different CAs has proven to be a bad idea since any CA can issue a certificate for any domain name they please like these guys did plus the fact that many CAs have suffered serious security breaches. What we've needed for years is some sort of DNS like system for certificates where certificates can be revoked and the action will be cascaded through the entire net quickly like domain name changes. There even have been proposals to use DNS for this purpose [] which as far as I understand it would render CAs redundant. Under the current system Google can only remove the certificates from the CA Root lists Google controls if the bad certificates have made it into those, and politely request that others who maintain CA Root lists do the same. I can only theorise that CA reform has proven problematic since implementing such a system would be taking a bowl of soup from the cauldron of certain set of people who have an interest in maintaining the old system and have resisted reform. I can't imagine any other reason why the certificate system hasn't been changed.

      • So what happens when the "bad guys" start revoking legitimate certificates? In this context, that would be MCS or CNNIC revoking Google's real certificates.
        I can imagine an NSA pulling a stunt like that as well.

      • by blippo ( 158203 ) on Tuesday March 24, 2015 @04:02PM (#49330517)

        It's a bit of a scam from the beginning. I remember almost 20 years ago I asked where the safety was in that we had to shell up a relatively large sum of money to some unknown company on the other side of the world, so that they could "verify" our identity (how exactly?) - just because they had bought (?) a place in Netscape's or Internet Explorer's root CA list.

        Since there are so many certificate authorities it's safe to assume that too many are compromised by- or under the influence of- criminal organisations or non-democratic and/or corrupt governments. (Ignoring the just-for-lulz hackers, I'm not that worried about them.)

        I really wished PGP/GPG-style trust chain model worked in real life, but it's a hassle even for techies.

        One idea would be to utilize the existing social networks + phones for something, but I doubt it would be possible to build something that is idiot-proof enough.
        (Especially since a lot of people seems to have no idea who some of their contacts actually are...)

        It could potentially solve email too though.

      • by Anonymous Brave Guy ( 457657 ) on Tuesday March 24, 2015 @04:08PM (#49330587)

        Trusting many different CAs has proven to be a bad idea

        Trusting any one of many different CAs has obvious vulnerabilities, as this case demonstrates (and it's not exactly the first time the problem of an untrustworthy CA has been observed in the wild). The current CA system isn't really a web of trust, because it ultimately depends on multiple potential single points of failure.

        One way or another, in the absence of out-of-band delivery of appropriate credentials, you have to trust someone, so I suspect the pragmatic approach is to move to a true web-of-trust system, where you trust a combination of sources collectively but never trust any single source alone, and where mistrust can also be propagated through the system. Then at least you can still ship devices/operating systems/browsers seeded with a reasonable set of initial sources you trust, but any single bad actor can quickly be removed from the trust web by consensus later while no single bad actor can undermine the credibility of the web as a whole. Such a system could still allow you to independently verify that the identity of a system you're talking to via out-of-band details if required.

      • A decentralized system is harder for a single group to control. It's better to have a list of CA's you trust than to be forced to use a single one (that you don't). A centralized system means the NSA controls trust.
      • by mcrbids ( 148650 )

        If only a domain could publish information about the CA authorized to sign its certificates... perhaps with a record via DNS called "info", and secured with something called DNSSEC so you can be relatively sure it's correct.

        Naw. Stuff like that couldn't happen, could it?

    • by antdude ( 79039 )

      I don't always agree with [] ... :P

    • by GuB-42 ( 2483988 )

      The problem is that we are using a _chain_ of trust rather than a _web_ of trust.

      The difference between the two is that in a chain of trust model, a certificate is signed by a single authority, whereas in a web of trust, a certificate can be signed by several authorities. In other words, a web of trust can do everything a chain of trust can do, and more.

      In the case of Google impersonation, the browser could require that google have at least 3 independent signatures from a trusted list. If one of the authori

  • by QuietLagoon ( 813062 ) on Tuesday March 24, 2015 @02:09PM (#49329265)
    Or at least their certs removed from valid CA Root lists that, for example, Mozilla uses []. If not, why not? A trust has been breached.
    • by BenJeremy ( 181303 ) on Tuesday March 24, 2015 @02:12PM (#49329289)


      Make an example out of them, at the very least. I doubt MCS or CNNIC will do anything to disengage themselves from the Chinese government (Most likely culprit here). Revoke their authority and put an end to this nonsense.

      • by Anonymous Coward on Tuesday March 24, 2015 @02:35PM (#49329567)

        So are we going to revoke Verisign's root CA certificate (and screw up the millions of websites that use their certs) when we eventually find out that the NSA strong-armed them into doing the same thing?

        • by Holi ( 250190 ) on Tuesday March 24, 2015 @02:38PM (#49329607)
          If we are serious about trust then yes, otherwise this isn't the beginning of the end, it's just the end. If the cert's cannot be trusted and we are not willing to take the steps to preserve that trust then the whole internet economy goes poof.
        • by sexconker ( 1179573 ) on Tuesday March 24, 2015 @02:51PM (#49329775)

          We should. We won't.

          A system built around certificate authorities is broken by design. Self-signed certs are much more secure than anything stamped by a CA.
          And can we start using client certs, please? I should be able to walk into my bank and hand them a unique cert that they attach to my account and use for verification. Additionally, I should be able to request a unique cert on their end that they use only for my account so I can do my own verification.
          Since this is all self-signed shit, it can be easily automated.

          For revocation, all either party has to do is stop using/trusting the cert. No one can regenerate the bank's unique cert that I trust because there is no authority with that power. No one can regenerate mine. If the bank wants to issue a new cert, I have to go in and get the new cert and trust it. You can dumb down your trust if you want - the bank could mail you the cert, mail you a letter saying it's going to be changed, post the thumbprint of the cert on their site, to their support phone line, whatever. If I want to issue a new cert, I have to get them to trust me in a similar fashion.

          Doing it this way is more work, but you have ACTUAL trust, negotiated equally by both parties. You can choose convenience over security if you want, but you're not subject to some government/CA MITMing everything on a whim.

          • by Anonymous Coward

            And what about when you need to be sure that a company that's half-way across the country (or planet) are who they claim they are? Just book a round-trip flight so you can pick up a copy of their cert in person at their corporate HQ?

            • by praxis ( 19962 )

              The company can generate a certificate (public and private key pair) and send you the public key pair through an unsecure channel. They can then tell you the fingerprint over a secure channel. You do the same. You each verify that the public key of the other party is actually the other party's public key and then you two can communicate securely.

              No, what constitutes a secure channel for key verification? That's where you can get levels of trust from one posted on their website (weak) to one read to you over

              • If you can't trust that the entity with which you're exchanging information has the security of the information as their highest priority, no amount of securing of channels is going to help.

                How do you know the person handing you the fingerprint hasn't switched it for a manky one?

                How do you know the server that generated the key hasn't been compromised?

                For that matter, how do you know that the remote entity hasn't been strong-armed into simply giving over all of your information? A government threatening to

                • If you can't trust that the entity with which you're exchanging information has the security of the information as their highest priority, no amount of securing of channels is going to help.

                  Why sir, I have no doubt that my insurance company/big-bog retailer, etc. is totally dedicated to keeping my information secure and not in simply making the cheapest token security gestures they can get away with.

                  After all, if you can't trust major corps like Anthem, Home Depot and Target, who can you trust?

                • by praxis ( 19962 )

                  Yes, of course you also have to trust the sender. We're talking about securing communications here, not trusting a sender. If you don't trust the sender, why even talk about trusting their communication? We need to first trust the sender, then we can think about "how do I know this message is from that specific trusted sender and not compromised."

                  Authentication using a certificate gives you no inherent trust of the other party. I thought that was obvious.

            • If you can't establish trust in a secure manner, then you cannot trust them.
              Welcome to actual security.

            • Realistically, what we need is a "web of trust". The idea that there are certain incorruptible agencies who can vouch for anyone is pretty preposterous to begin with.

              If, instead, anyone could vouch for another and we could build up our own list of trusted authenticators and score unknown parties against their associations, a la degrees of Kevin Bacon, it would probably be a lot more secure than the current binary system with unreliable certifiers in it.

              As it is, I'm already dealing with a number of agencies

          • Next stop is for actual CCP or PLA boots on the ground. I'm convinced the velvet gloves come off. Either code a back door into your web services for official government access, or don't have a physical presence in the mainland. As for the MITM attack, totally legal. What are you going to do, sue the Chinese government??!

          • by arth1 ( 260657 ) on Tuesday March 24, 2015 @04:11PM (#49330615) Homepage Journal

            The irony here is that Google wants https with chain-of-trust certificates, and advocate https, and without self-signed certs harder than anyone. Now it comes back to bite Google's own derriere.

            The reason they want https (or SPDY or HTTP/2.0) everywhere isn't our best interest, but because you can't easily hide behind caching proxy servers, giving them better fingerprinting as well as a higher hit count on ads.

            When I have to go to Google, I go to the non-redirecting http page [] they have hidden.
            My personal privacy is worth more to me than the risk of a 3rd party listening in on my searches (other than the three letter agencies who already listen in).

            • by Anonymous Coward
              Actually, Google doesn't rely on CAs as much as it appears at first glance: Chrome and Firefox come with Google's public keys [] and will not accept other keys. Not sure what other browsers do the same, although obviously not all of them (otherwise the attack this article is about never would have happened).
          • by vux984 ( 928602 )

            Self-signed certs are much more secure than anything stamped by a CA.

            Agreed, sort of. Its true ONLY if you load the client browser with the cert. There no security at all in being presented an arbitrary and here-to-for unknown self-signed-cert when browsing the the web, which means self-signing is suitable for managing your own users securely; more securely than than using the major roots.

            But -- one -- unless you actually remove the major roots; and we assume they're compromised then they can still present valid certs for your stuff - so switching to self signed doesn't real

            • The cert is as secure as the cryptography and implementation.
              The trust is up to you, not some web of "authorities".

              • by vux984 ( 928602 )

                The cert is as secure as the cryptography and implementation.

                The point however, is that, as implemented, if you trust verisign as a root CA for any domain; then you trust verisign as a possible root CA for ALL domains.

                Including your own private domain, the one you signed yourself, and installed your own certificates for.

                The trust is up to you, not some web of "authorities".

                But you and I when presented with a self-signed certificate on the world wide web are not generally in a position to have any information at all whatsoever whether to trust it or not.

                The web of authorities may be broken and unreliable in edge cases; b

            • by dog77 ( 1005249 )
              If the self signed idea is combined with trust authorities (not signers), that verifiy this certificate is actually a valid one, and is say verified to be valid by several trust authorities (e.g. Google, Microsoft, Ubuntu,, etc) who you do have certificates for then I think it is a good alternative or supplemental approach to what we currently have.
          • by dog77 ( 1005249 )
            I second this, and add that we should start using trusted authorities to get, verify, and monitor all of the self signed public certificates, similar to how PGP works. We generally trust a few reputable companies and organizations and so these entities could setup the registries for the self signed certificates, and could monitor and establish mechanisms for generating creditibilty ratings for certificates. They can monitor for complaints, fraud, abuse, impersonations, etc. Your browser and operating s
          • by Lennie ( 16154 )

            Your bank still has an office you can go to ?

            Mine doesn't anymore, they are busy getting rid of all their bank locations and clerks.

            Automation is what they want.

            And getting rid of cash seems to be a policy.

            They are even reducing the number of ATMs.

            This doesn't just apply to the my bank, but all banks in my country.

            Even if they had an office I could go to, I doubt the clerk knows security procedures well enough to check if my ID is correct.

            So, no, I don't think your idea will work. :-(

        • by DarkOx ( 621550 )

          Yes its a To big to Fail problem, just in another form. If your browser throws errors on just about ever site you visit pretty soon "many" people will start using another browsers. So no we won't revoke Verisign's root pretty much no matter what.

          Maybe an independent like Mozilla might would drop them, if the entire Verisign organization was discovered by an NSA front run by vampires with pedophilia it could happen but even then its only a maybe at best.

          • Yes its a To big to Fail problem, just in another form.

            If anything is too big to fail, you are usually better off making it fail anyway as soon as possible to minimise the damage. Some of the problems in the global financial industry today aren't because of inherent weaknesses in the system. Instead they have been caused precisely by allowing organisations to grow too big, or perhaps more accurately by allowing them to take on disproportionate levels of risk, and then supporting those organisations at government level instead of allowing them to go under when t

          • by sjames ( 1099 )

            Just make the block screen read blocked for the sake of the children.

        • by Trogre ( 513942 )


        • by sjames ( 1099 )

          Yes. No exceptions, breech trust == no longer trusted.

          The CAs inclined to integrity will be able to use the potential wipeout as a good reason their cooperation can't be legally demanded and the less scrupulous may be deterred by the consequences.

          Meanwhile, what's the alternative? Bend over and spread 'em wide?

      • by Zocalo ( 252965 )
        Personally, I'd say screw them, revoke the certificates in the OS/browsers, and let CNNIC figure out how to sort out the mess with their customers. Even if you were to then allow them to create a new certificate, they'll still need to go through the financial and administrative pain of having to re-issue all the certificates to their immediate customers like MCS, who will then have to re-issue all their certificates and so on... That's a huge slap on the wrist and a massive deterrant to any other CA messe
        • In the meantime, you can always delete the trust yourself. Open your Browsers Certificate List ("Options, Advanced, Certificates, View Certificates" in Firefox), find CNNIC's certs (there are two in Firefox - "CNNIC ROOT" and "China Internet Network Information Center EV Certificates Root") and either delete them altogether or edit the trust and remove the ability to sign websites.

          What happens the next time there's an update to firefox?

    • by gnasher719 ( 869701 ) on Tuesday March 24, 2015 @02:13PM (#49329297)
      It seems that you are right. It very much looks like there was a genuine Certificate Authority behind this, and that means an Internet death sentence needs to be issued - removing that Certificate Authority from the root certificates of Windows, MacOS X, iOS, Android, Linux etc.
      • by RelaxedTension ( 914174 ) on Tuesday March 24, 2015 @02:34PM (#49329557)
        Yup, same as DigiNotar. This company is no longer trustworthy, regardless of if this happened on purpose, or due to being incompetent.
      • by Anonymous Coward

        It seems that you are right. It very much looks like there was a genuine Certificate Authority behind this

        If you believe that Verisign, or any other US-based CA would refuse a 'request' from NSA to quietly issue them a certificate in the name of a 3rd party, then you haven't been paying attention. If you believe there are no CAs or CA employees willing to issue false certs in exchange for money or favors, then you're also naive. The 'web of trust' is a tool, like a password, and it does not guarantee anything.

        • If the consequences are severe enough, they would have to refuse. Would the NSA even push that hard if both parties knew that this would be a death sentence for Verisign once the truth emerged?

          • by ahodgson ( 74077 )

            It's more likely the NSA would hack Verisign, take their keys, and use them to create whatever certificates they want. And if you think they care about what happens to Verisign as a result, I have a bridge to sell you.

      • by kbonin ( 58917 )

        Agreed. The ONLY effective punishment for a CA that breaches trust or competence this poorly is to mark its roots as permanently untrusted. In a world that has set aside morals and ethics (or redefined them into doublespeak meaninglessness), the only punishment that will actually make corporations change their behavior are penalties that significantly exceed the full gains of breaking the rule or law. The related challenge is raising the certification bar, so this doesn't become a "whack a mole" with CCN

    • A lot of people were predicting this type of problem back when certs were being pushed out and proclaimed to be the solution to security.
      (There have been numerous other issues of fraudulent certs, but I don't think they were as large as Google.)
    • Re: (Score:3, Interesting)

      by Ted Stoner ( 648616 )
      I am annoyed that Firefox does not respect my choices for trusted certs when it does an update. Every time FF updates I go in an un-trust certs from CAs from foreign countries (China, Turkey, etc.). But after the next update, they are back. This is not a secure way to operate.
    • Or at least their certs removed from valid CA Root lists that, for example, Mozilla uses []. If not, why not? A trust has been breached.

      The truth is that users have no way of knowing which of the tens of certificates included in the browser to leave and which to remove. This Super User question remains without a satisfactory answer, even as browser cert issues pile up almost monthly: []

  • by Tablizer ( 95088 ) on Tuesday March 24, 2015 @02:27PM (#49329475) Journal

    Please explain why we offer nearly tariff-free trade with such a prick country? They bleep with US entertainment companies, networking companies, search companies, etc. etc.

    • by nitehawk214 ( 222219 ) on Tuesday March 24, 2015 @02:31PM (#49329521)

      Because American voters can't see past the end of their noses. If congress enacted laws that increased prices on their Wallmart goods, they would be voted out so fast. Coupled with this the fact that the lobbies of corporations want to keep the status quo that keeps them rich.

      • by Anonymous Coward

        It's so cute how you think voters had anything at all to do with this. Quaint fairy tale, there.

        • by Tablizer ( 95088 )

          Amen! The lobbyists and "campaign contributors" slipped in lopsided trade slice by slice starting around the mid 1960's. Polls of citizens consistently showed voters ambivalent about lopsided trade. It's being blindsided in slow motion.

      • It is said that a Capitalist will sell you the rope you use to hang him. American companies have willingly sold out their own industrial base in order to gain a few extra percent of profit for the next quarter.
    • Re: (Score:3, Insightful)

      by gstoddart ( 321705 )

      And, so what?

      American spy agencies fuck with everybody else on the planet. Are you laboring under the belief you are special little flowers or something?

      On behalf of the rest of the world, listening to Americans complain about what the Chinese are doing is pathetic.

      Because you don't seem to give a shit about how we feel about you spying on us.

      • by Tablizer ( 95088 )

        I'm not talking about spying, but of interfering with commerce.

        • by gstoddart ( 321705 ) on Tuesday March 24, 2015 @03:55PM (#49330439) Homepage

          Oh, well, if it's commerce it's magically exempt and everybody will know it's divine and protected by god, right?

          Sorry, but do you expect us to use the US wouldn't use spying for commercial advantage if they had a chance? Or that they don't? Or that they restrict how they spy on everybody else int he world?

          The difference between the US government saying "We can break into any system we want" and the Chinese government saying "We can break into system we want" is the self entitled nature of the person who says they're different.

          These two are exactly the same. Claiming otherwise is just exceptionalism. It's just one government hacking security for their own ends.

          To everyone who is neither American nor Chinese, you're both convinced magical unicorns give you the right to do as you please.

          • by Tablizer ( 95088 )

            but do you expect us to use the US wouldn't use spying for commercial advantage if they had a chance?

            Guilty until proven innocent?

            These two are exactly the same. Claiming otherwise is just exceptionalism.

            Sorry, I don't see it that way. I expect all nations to spy for political and military reasons and I don't blame them for doing it. But the gov't spying for commercial advantage of non-military products is a different issue.

            From another perspective, if a nation is caught cheating, they have no right to ask

          • What magical country do you live in that doesn't spy? Ethiopia?

            • I live in so such magical country.

              I'm saying I don't trust any of them, and people pretending like "this kind of spying is good and this kind is bad" or that it's "OK when we do it but not when they do" ... well, I think those people are full of shit.

              Countries can, will, and do spy for any benefit they can find for themselves. They'll also barter that information for even more benefit to themselves.

              The rules are there are no rules. All of the countries have admitted they do it, and will continue to do it.

      • by flonker ( 526111 )

        We don't want American spy agencies listening to our https traffic either. Just because Alice is shooting at me, it doesn't suddenly make it OK for Bob to stab me too.

        This is an attack against the SSL trust model. A CA knowingly created a rogue certificate for malicious purposes. This wasn't an accident. A Diginotar type response would not be inappropriate.

    • I've got some other questions that might help answer yours.

      What country owns a large portion of New York City?
      What country owns a significant portion of the US-based shipping companies?
      What country has huge cash reserves of US currency?
      What country owns more than 10 percent of the US federal debt?
      What country has invested in more than 60 of America's most visible brands?

      The answer is not the USA.

      We offer low-trade with such a country because it is not in America's best interest to put up trade barriers betw

  • by tekrat ( 242117 ) on Tuesday March 24, 2015 @02:33PM (#49329547) Homepage Journal

    Sooner or later, greed trumps useability. Companies are going to screw one another over in attempts to dominate. We, the users of the internet, lose when these entities play their games on one another, and sooner or later we are going to take to take our marbles and go home -- it's not worth it to play.

    I feel we have already reached this state; between the NSA essentially hacking every router as it leaves the factory to China issuing false certs to Google putting their own interests at the top of every search, it seems that the time has come to either consider some international organization to regulate the internet, or abandon TCP/IP and start again with a whole new internet based on something else. Clean sheet.

    The way we are currently headed will breed a cesspool of an internet you can't trust for anything -- so why would you use it for shopping, news, banking, or any other activity if you KNOW that every single time you do, you will regret using this medium for anything?

    If Amazon, Google, CNN, and heck even Facebook want to stay in business, they need to learn to stop fucking around with their users, because I've essentially had it, and I'm guessing that I cannot be alone in my disdain and distrust of what has become of an internet I used to like.

    • by cavreader ( 1903280 ) on Tuesday March 24, 2015 @02:46PM (#49329697)

      Oh yes another International organization. The current ones have such a wonderful track record. Maybe the UN can take over the internet regulations.

    • The beauty of the Internet is that you can do your part all by yourself, without waiting for anyone else to get their shit together first. You don't need to start a movement, you don't need to tear anything down or build some international organization to oversee everything. Just do what you said -- stop using Google, stop trusting root CAs, roll your own encryption, use VPNs, etc.

      If other people want to continue using commercial / government crap, well, that's their prerogative. If it's as bad as you say

  • by gstoddart ( 321705 ) on Tuesday March 24, 2015 @02:38PM (#49329601) Homepage

    Can't pretty much any high enough level certificate authority issue any damned certificate it wants?

    You think America or any other country can't do this stuff? You think they don't?

    Sorry, but when every other damned nation is spying and lying, WTF difference is it when China does it? You don't get to pretend it's OK for one country but not another.

    Until we start designing stuff which is inherently more secure, and which doesn't have back doors for government .. this is the state of security. You may or may not have it, you have no control over that fact.

    America doesn't want people to bypass their spy apparatus any more than China does. Let's not pretend this is any different.

    • by SuricouRaven ( 1897204 ) on Tuesday March 24, 2015 @02:42PM (#49329657)

      The big difference is that China got caught. I'm sure the US has this capability too - but they use it only in targeted intercepts, so as to maintain deniability.

    • by JustNiz ( 692889 )

      >> Until we start designing stuff which is inherently more secure

      I agree but I'm afraid that If something was truly secure enough that the NSA cant hack it, the US gov would just find a lame excuse to make it illegal.

    • Can't pretty much any high enough level certificate authority issue any damned certificate it wants?

      Yes, they can. But that only works if Microsoft puts a root certificate for that certificate on all Windows PCs, and Apple puts it on all Macs and iOS devices, and Google puts it as a root certificiate on all Android devices and so on. If you get caught, the next Windows/Apple/Google security update removes the root certificate, and that certificate authority is dead.

  • My company had massive amounts of fraudulent connection attempts originating from china. We geoblocked china and 95% of it went away. I feel for what the people who live there have to endure but I give ZERO $hits about the negative effects of blocking access to a country that blatantly allows and endorses state sponsored criminal hackers attacking businesses.

    I believe in one set of rules for everyone. How do you suppose China would respond if the tables were turned and the governments of GB,France,Germany,U

    • I believe in one set of rules for everyone.

      There is one set of rules for everyone: every government on the planet has decided it is legal for them to spy on anybody they want.

      Sorry, but once the US and UK governments publicly said it was OK, how the hell can you expect it to be different when the Chinese do it?

      Sorry, but the level of cognitive dissonance required for that isn't sustainable.

  • Revoke the certs (Score:5, Insightful)

    by Imagix ( 695350 ) on Tuesday March 24, 2015 @02:52PM (#49329779)
    At a _minimum_ MCS's rights need to be revoked. There needs to be an independent audit of any cert that CNNIC has issued _at CNNIC's expense_, and of their operations (both CNNIC, and the organizations to which they've issued certs), or CNNIC should have its rights revoked as well. MCS is completely untrustable, and CNNIC has to prove that they are currently trustable. CNNIC's operations need to be audited or they may just turn around an issue a new cert to MCS. (Or "MCS" with a new name)
  • by Anonymous Coward believe that China is the only government doing this.

!07/11 PDP a ni deppart m'I !pleH