Re: [rtcweb] Resolving RTP/SDES question in Paris

[Igor Faynberg <[e-mail]>]

Harald,

Many thanks!  I did just what you suggested, and spent happy three hours 
figuring out what is going on.  I found something that claims to be my 
own certificate, allegedly signed by me (which I swear I have never 
done) as well as many other certificates from the authorities I never 
knew (nor could find any information about).  On top of all, I found two 
certificates that allege being issued by Microsoft, while they are 
marked as fraudulent. (So somenone is checking this stuff and takes action?)

The above report speaks for itself.

The key finding though is that the browser interface in NOT the only way 
to get the certificates in.  Anyone can put them in a directory, and 
this a big problem for the "hacker meaning."   Incidentally, this is not 
only the browser matter--same holds for the OS.

If root certificates were to be installed only through the browser 
administrative interface, I imagine the browser could send me a warning 
or even deny the installation.  I know there is a lot to think through 
on how to bootstrap this process, but I think it should  be possible to 
achieve.  But in this case it appears to me that the browser would need 
to have its own independent file system controlled only through the 
administrative interface.

It also appears to me that the interface should be password-protected so 
that only the legitimate owner (including corporate) can control the 
installation of root certificates. If the hacker who does not know the 
administrative password just got  access to my computer (say, via JS), 
there is no way for this hacker to  install the certificate.

I know that this issue takes off on a tangent from the RTCWeb 
discussion, so I don't want to start that. But I wanted to acknowledge 
your message and thank you for responding.  Maybe we could talk about 
this with you, Hui-Lan, and Eric off-line.

Igor

On 3/20/2012 6:41 AM, Harald Alvestrand wrote:
> Igor,
>
>
> in Chrome, go to chrome://settings/certificates, choose the 
> "authorities" tab, and note the presence of the "import" button.
>
> All browsers (as far as I know) have similar mechanisms.
> "Owning" your computer will achieve this goal both in its corporate 
> meaning and in its hacker meaning.
>
>