Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #3347 > unrolled thread

Security issue

Back to article view | Back to comp.os.linux.networking

Contents

  Security issue Paulo da Silva <p_s_d_a_s_i_l_v_a_ns@netcabo.pt> - 2015-04-16 15:10 +0100
    Re: Security issue J G Miller <miller@yoyo.ORG> - 2015-04-16 21:21 +0000
      Re: Security issue Paulo da Silva <p_s_d_a_s_i_l_v_a_ns@netcabo.pt> - 2015-04-17 01:38 +0100
        Re: Security issue J G Miller <miller@yoyo.ORG> - 2015-04-18 20:21 +0000
          Re: Security issue Paulo da Silva <p_s_d_a_s_i_l_v_a_ns@netcabo.pt> - 2015-04-20 01:55 +0100
            Re: Security issue "John F" <j@j.ii> - 2015-04-22 13:36 -0700
    Re: Security issue Christian Riechers <chriechers@netscape.net.invalid> - 2015-04-18 07:52 +0200

#3347 — Security issue

Hi!

I have two firefox profiles.

In one of them, whem I try to access a given https site, a pop up dialog
box from ff appears. Here is a translation from pt of that message:

"You asked Firefox to connect securely to <site here>, but we can not
confirm that your connection is secure.

Usually, when you try to connect securely, sites have the security ID to
prove that you are on track. However, the identity of the site can not
be verified.

What should I do?

If you usually connect to this site regularly without problems, this
error could mean that someone is trying to pass himself off by this site
and as such you should not continue."

Then there are 3 options to choose from ...
Get me out of here
Tech. info
I understand the risk

What, in simple words, does this mean?
Why using the other profile this message does not show up?
Is it possible that each profile has its own certificates' list?
Where do these certificates come from?

I have checked security and privacy configurations and couldn't see any
diffs!

Thanks for any help.

[toc] | [next] | [standalone]

#3348

On Thursday, April 16th, 2015, at 15:10:53h +0100, Paulo da Silva asked:

> What, in simple words, does this mean?

The most probable cause is that the certificate which the site is
presenting is not a trusted certificate for that site.

The cause of this can be that the certificate is self signed and
has not been purchased from Thwaite, Verisign, or another recognized
CA, or that the certificate has expired, or that the certificate is
for one host name but is being used for another related host name.

So in cases such as this, the best thing to do is to click on
"I understand the risks" then in the new dialog to click on
"get certificate" and "view certificate" and very carefully
read the details and the reason why Firefox thinks the certificate
is not fully acceptable.

> Is it possible that each profile has its own certificates' list?

Yes this is most probably the reason that in one profile you clicked
to accept the certificate and store it permanently as an exception.

You can check the certificates list which have been accepted via
Edit -> Preferences menu, then Advance button, then Certificates tab,
then View Certificates button.

> Where do these certificates come from?

From the site that you visit using the https address.

> I have checked security and privacy configurations and couldn't see any
> diffs!

But obviously not the stored certificates list under advanced.

A good example of when accepting a certificate is valid, although
the certificate is not fully valid, would be when you access the
https interface on your LAN router instead of the http addres.

The certificate will have been issued to Cisco or D-link or whoever,
but since it does not know which local domain address you would be using,
thus it cannot fully conform to the required authentication standard,
Firefox complains as it should.

[toc] | [prev] | [next] | [standalone]

#3349

On 16-04-2015 22:21, J G Miller wrote:
> On Thursday, April 16th, 2015, at 15:10:53h +0100, Paulo da Silva asked:
> 
>> What, in simple words, does this mean?
...

> 
> So in cases such as this, the best thing to do is to click on
> "I understand the risks" then in the new dialog to click on
> "get certificate" and "view certificate" and very carefully
> read the details and the reason why Firefox thinks the certificate
> is not fully acceptable.
It says "for unknown reasons"

> 
>> Is it possible that each profile has its own certificates' list?
> 
> Yes this is most probably the reason that in one profile you clicked
> to accept the certificate and store it permanently as an exception.
> 
> You can check the certificates list which have been accepted via
> Edit -> Preferences menu, then Advance button, then Certificates tab,
> then View Certificates button.
I checked and in both profiles "MULTICERT - Entidade de Certificação
001" is there!
I created a new profile and I couldn't also enter in the site. I created
a permanent exception and "MULTICERT - Entidade de Certificação
001" was created under "servers" tab but under a different root than
that under "authority" tab. Besides, the other previous profile from
which I can also directly enter the site does not have this entry under
"servers" tab. So I cannot understand what is different between both
previous profiles and where the differences, if any, came from.

Anyway this is a gov site. So I'll add a permanent exception. What is
causing me problems is the firefox statement "If you usually connect to
this site regularly without problems, this error could mean that someone
is trying to pass himself off by this site
and as such you should not continue."
But I think this should not be possible because I have at least one
profile that does not issue this pop up message. Am I right?

> 
>> Where do these certificates come from?
> 
> From the site that you visit using the https address.
I am referring to the ones listed in the firefox. Does firefox comes
with them? Is it possible to change them only by visiting some site?
Are they in the user dir (kubuntu here)?

Thanks and sorry for too many questions :-)

[toc] | [prev] | [next] | [standalone]

#3351

On Friday, April 17th, 2015, at 01:38:12 +0100, Paulo da Silva explained:

> I created a permanent exception and "MULTICERT - Entidade de Certificação
> 001" was created under "servers" tab but under a different root than
> that under "authority" tab.

A different root?  If I understand correctly it means that the exception is
signed by  a different CA (certificate authority) which if it is not recognized
as being authoritative (ie no relevant CA authority certificate installed on
your system) could well be the cause of the problem.

> What is causing me problems is the firefox statement "If you usually connect to
> this site regularly without problems, this error could mean that someone
> is trying to pass himself off by this site and as such you should not continue."

This is an important warning because it signals possible "man in the middle"
attacks.  In your case, if you can verify that you are directly connected to
the Government web site (check very carefully the address in the URL bar and
look up the IP address and do a whois to see that it belongs to the government
or their contracted out service) then it is most probably safe to continue.

> I am referring to the ones listed in the firefox.

The ones that come by default are part of your GNU/Linux distribution which
supplies numerous CA certificates and perhaps some 

Look in /usr/share/ca-certificates and to see which one are actually being
used, look in /etc/ca-certificates.conf.   On Debian/Mint/Ubuntu systems
one has to do an update-ca-certificates if manually adding one's own
certificates, or the system will do it automagically when updating the
cerficates package when new versions of certificates are added or old obsolete
ones removed.

> Does firefox comes with them?

Not usually -- most, it not all, are bundled together in the ca-certificates
package (for Debian/Mint/Ubuntu), but it may be slightly different with other
distributions.

> Is it possible to change them only by visiting some site?

Well it is not a case of changing them by visiting sites, but a case of adding
site certificates if they are not signed by a recognized CA, as in
certificate authority (root of the certificat) certificate which is not
installed.  It is possible to go to numerous web sites for well known
organizations, search their web pages for a downloadable certificate,
and it it manually to the system.  It is not just Firefox which uses
certificates, but also e-mail MTUs (eg courier, exim, sendmail), IPSEC and
VPN services, IMAP and POP mail services, in order to verify that the site
you are trying to connect with, is really the true site before sending your
secret password or other confidential information.

> Are they in the user dir (kubuntu here)?

Aha, you are a Kubuntist.  In the /usr dir yes, as previously explained,
under /usr/share/ca-certificates, managed by /etc/ca-certificates.conf

> Thanks and sorry for too many questions :-)

No problem at all -- better to be cautious and understand the security
mechanism before connecting to a bad site and releasing your confidential
personal information, because one such a mistake has been made, there is
no way to reverse the outcome.


If you want to see a rather nice "interactive" how does certifcate
exchange works web page, take a look at

<http://www.kentlaw.EDU/faculty/rwarner/classes/legalaspects/digital_signatures/tutorials/DCD.html>

and what happens to set up the SSL (secure) connection at

<http://www.kentlaw.EDU/faculty/rwarner/classes/legalaspects/digital_signatures/tutorials/SSLD.htmL>


There are also diagrams of how the certificate chain works at

<http://docs.oracle.COM/cd/E19424-01/820-4811/gdzea/index.html>

which should give you better understanding of why Firefox is complaining.

[toc] | [prev] | [next] | [standalone]

#3352

On 18-04-2015 21:21, J G Miller wrote:
> On Friday, April 17th, 2015, at 01:38:12 +0100, Paulo da Silva explained:
> 
...

> 
> If you want to see a rather nice "interactive" how does certifcate
> exchange works web page, take a look at
> 
> <http://www.kentlaw.EDU/faculty/rwarner/classes/legalaspects/digital_signatures/tutorials/DCD.html>
> 
> and what happens to set up the SSL (secure) connection at
> 
> <http://www.kentlaw.EDU/faculty/rwarner/classes/legalaspects/digital_signatures/tutorials/SSLD.htmL>
> 
> 
> There are also diagrams of how the certificate chain works at
> 
> <http://docs.oracle.COM/cd/E19424-01/820-4811/gdzea/index.html>
> 
> which should give you better understanding of why Firefox is complaining.
> 

Thank you very much for your enlightenments and for the links.

I'll take a look at them.

Regards.
Paulo

[toc] | [prev] | [next] | [standalone]

#3353

"Paulo da Silva" <p_s_d_a_s_i_l_v_a_ns@netcabo.pt> wrote in message 
news:mh1iqp$90b$1@speranza.aioe.org...
> On 18-04-2015 21:21, J G Miller wrote:
>> On Friday, April 17th, 2015, at 01:38:12 +0100, Paulo da Silva explained:
>>
> ...
>
>>
>> If you want to see a rather nice "interactive" how does certifcate
>> exchange works web page, take a look at
>>
>> <http://www.kentlaw.EDU/faculty/rwarner/classes/legalaspects/digital_signatures/tutorials/DCD.html>
>>
>> and what happens to set up the SSL (secure) connection at
>>
>> <http://www.kentlaw.EDU/faculty/rwarner/classes/legalaspects/digital_signatures/tutorials/SSLD.htmL>
>>
>>
>> There are also diagrams of how the certificate chain works at
>>
>> <http://docs.oracle.COM/cd/E19424-01/820-4811/gdzea/index.html>
>>
>> which should give you better understanding of why Firefox is complaining.
>>
>
> Thank you very much for your enlightenments and for the links.
>
> I'll take a look at them.
>
> Regards.
> Paulo
>

Yes, these are very helpful! :)

Thanks J G Miller 

[toc] | [prev] | [next] | [standalone]

#3350

On 04/16/2015 04:10 PM, Paulo da Silva wrote:
> Hi!
> 
> I have two firefox profiles.
> 
> In one of them, whem I try to access a given https site, a pop up dialog
> box from ff appears. Here is a translation from pt of that message:
> 
> "You asked Firefox to connect securely to <site here>, but we can not
> confirm that your connection is secure.
> 
> Usually, when you try to connect securely, sites have the security ID to
> prove that you are on track. However, the identity of the site can not
> be verified.
> 
> What should I do?
<snip>

Can you provide a link for the site?

[toc] | [prev] | [standalone]

Back to top | Article view | comp.os.linux.networking

csiph-web