Subject: Re: [pkix] fyi: Detecting Certificate Authority compromises and web browser collusion

From: Peter Gutmann <[email-masked]>
Date: Sun, 03 Apr 2011 01:13:22 +1300

[CC'd to the Mozilla security-policy list, maybe someone there can explain
 what's going on here].

"Ed Gerck, Ph.D." <[email-masked]> writes:

>First, "Larry" does not know what's going on.   This is the same Larry that
>affirms "You are connected to xyz.com which is run by (unknown)" for a valid
>cert for a known entity, which is clearly named in the O field and is
>digitally signed in the cert.

Try going to, for example, https://www.microsoft.com.  "This site does not
supply identity information / Your connection to this site is only partially
encrypted".  MSIE has no such problem (and yes, it does work for non-MS sites
as well :-).  I suspect Larry may have been hired away from the TSA's
passenger-screening program...

>I suspect that Larry is just a bouncer for non-EV certs.

That could well be the case.  He certainly seems to create the impression that
EV cert = good, anything else = bad.

Peter.

---

From: Stephen Kent <[email-masked]>
Date: Mon, 4 Apr 2011 11:23:16 -0400

>passenger-screening program...

I did not get a message of this sort when I connected, but then I did
terminate the home page downloading when it ran on and on and ...

Steve

---

From: Peter Gutmann <[email-masked]>
Date: Wed, 06 Apr 2011 18:56:02 +1200

>terminate the home page downloading when it ran on and on and ...

What happened when you clicked on Larry?  It could have been because the page
never finished loading, but all I get is 30K of HTML and 340 kB of images
("viewed page on Microsoft gigabit LAN, couldn't reproduce slow page load
problem, resolved wontfix").

Peter.