[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]
[tor-bugs] #29628 [Applications/Tor Browser]: Distrust DarkMatter Intermediate CAs
#29628: Distrust DarkMatter Intermediate CAs
-----------------------+------------------------------------------
Reporter: nsuchy | Owner: tbb-team
Type: defect | Status: new
Priority: Immediate | Component: Applications/Tor Browser
Version: | Severity: Critical
Keywords: | Actual Points:
Parent ID: | Points:
Reviewer: | Sponsor:
-----------------------+------------------------------------------
Mozilla Firefox's root trust store trusts an intermediate ca for a spying
firm called DarkMatter. They trust they intermediate ca as it was signed
by Quovadis.
This already puts Tor users at risk as they can spy today, however once
they are a root ca there will be no oversight by Quovadis/Digicert and
they can misbehave and issue secret certificates to spy on Tor users.
They have a business interest in spying on HTTPS traffic. Google Chrome
and Mozilla Firefox are still discussing this. It's in the best interest
of Tor Users to immediately distrust the intermediate CA.
Thoughts?
References:
https://www.bleepingcomputer.com/news/security/cybersecurity-firm-
darkmatter-request-to-be-trusted-root-ca-raises-concerns/
https://protonmail.com/blog/dark-matter-quo-vadis/
--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/29628>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online
_______________________________________________
tor-bugs mailing list
tor-bugs@xxxxxxxxxxxxxxxxxxxx
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-bugs