![Mozilla and Google Come Down on the Side of Privacy [DarkMatter] - cover graphic](/_next/image/?url=https%3A%2F%2Fcdn.venafi.com%2F994513b8-133f-0003-9fb3-9cbe4b61ffeb%2F4d229b36-2160-4303-90d9-fa7d11bccbd7%2Faid_field_img__9865aa3d1a87570ab8947bcc389fb259.jpg%3Fw%3D864%26h%3D370%26fm%3Dwebp%26q%3D75%26fit%3Dcrop&w=3840&q=75&dpl=dpl_4VKQiEGhyRo2pdmM6GPzT1nMCMi4){kind=small}
Just a few weeks ago, Mozilla added DarkMatter-issued certificates to Firefox’s OneCRL blocklist and rejected its inclusion into its trust store. This inserts some punctuation in a lengthy industry debate as to the ethics of allowing suspiciously connected entities to run the gauntlet on the internet
The debate
As stated by Venafi’s Kevin Bocek, VP of security and threat intelligence, “[DarkMatter] is operating according to spec. They've got great staff. ..They've got the best.”
When it comes to standards and compliance, “[DarkMatter] will likely meet those standards” affirms the Electronic Frontier Foundation (EFF), initial heralds of the warning cry to Mozilla, Apple, Microsoft and Google. “But the standards don’t take into account an organization’s history of trying to break encryption, or its conflicts of interest.”
As of last year, links had been drawn between illicit Project Raven and the overseas CA. The clandestine operation paired United Arab Emirate operatives with former NSA members to spy on and track political dissidents, journalists and activists. The spotless reputation of the otherwise above-board certificate authority had been difficult to maintain ever since.
"While there are solid arguments on both sides of this decision, it is reasonable to conclude that continuing to place trust in DarkMatter is a significant risk to our users," finally concluded Wayne Thayer, certification authority program manager for Mozilla.
SSL/TLS Certificates and Their Prevalence on the Dark Web
Mozilla and Google put a stake in the ground for privacy
Google must have concurred as two weeks later, they did the same thing.
DarkMatter-issued TLS certificates will soon be absent from Android, Chrome and Firefox trust stores. The secure HTTPS connections affected will now show an error message once the ban is implemented.
With Google’s move, the momentum takes a hard shift in the direction of erring on the side of privacy when it comes to trust.
Said Wilson, “I agree with [coworker Gijs Kruibosch] ...that [an] applicable analogy is being a guarantor on a large loan...you should never ‘be a guarantor for anybody unless you're very, very sure of that person, because you have effectively no recourse if the debtor leaves you holding the bag’.”
Apparently when it came to the smoke surrounding DarkMatter’s inclusion, neither Google nor Mozilla wanted to risk the fire.
Only you can protect your machine identities
As stated by Venafi's Bocek, “If you don't take an active role in whitelisting and blacklisting the CAs in your trust stores—everywhere from the desktop to application servers to the cloud—you may end up incidentally trusting hundreds of CAs that you have no relationship with to enable others, including hackers, to be trusted.”
Even Mozilla admitted to needing to "up their game” when it comes to managing the sprawling number of certificate authorities: “[w]ith over 3,000 subordinate CA certificates chaining to root certificates in Mozilla’s program, we need automation to extend checks and balances to all of them,” wrote Kathleen Wilson. It’s automation and every man for themselves in what can still very much be termed the “wild west” of cyber security.
The decisions of Mozilla and Google may set a precedent in favor of privacy when it comes to CA root store inclusion. However, the frailty of the decision-making process makes it incumbent on individual enterprises to keep track of their own keys and certificates, examine all trusted CAs and have full visibility over their machine identities because if they don’t - there’s always an interested entity who will.
Why Do You Need a Control Plane for Machine Identities?
Related posts
Machine Identity Security Summit 2024
Help us forge a new era of cybersecurity
☕ We're spilling all the machine identiTEA Oct. 1-3, but these insights are too valuable to just toss in the harbor! Browse the agenda and register now.