On the SSL certification framework

Came upon this post in Reddit: https://www.reddit.com/r/techsupportgore/comments/4tobss/my_library_wants_me_to_install_a_root_certificate/

ELI5: A root certificate installation allows the organization providing the certificate to pretend to be any website they want to be, without your knowing it happened. It does so by taking your web request, submitting it's own request to the web server as if it is yours, receiving the reply, then sending the reply to you as if it came from the web server. The role the root certificate performs in this is in successfully deceiving you that you have actually communicated directly with the web server.

For what legitimate purposes should an server use this method of serving webpages to a client? There are a few I can think of: - The server acts as an intermediary that scans websites for malicious content, and wants the scanning to cover encrypted websites. After all, it's a wild world out there on the internet. Organizations usually deploy their own root certificate to company managed devices through group policy. - The server wants to prevent you from viewing questionable content, even if the content is protected by encryption. We are of course talking about parental controls here.

What issues would people have with installing root certificates on their computers and mobile devices? - Especially from the example above, you have no idea whether sufficient control has been placed over the issuance of the certificate. You don't know if you can trust the people working there, you don't know if they are spying on you or capturing passwords, you don't know if they are actively changing the content before it comes to you. - Unless it is a company computer, for which the company administrators take full responsibility for whatever happens, your computing device belongs to you, and you should not give a blank cheque for people to pretend to be whoever they want to be.

Digging deeper into the issue: - If you do not choose to accept the certificate install, can you still view your content? Of course you can! It is just blocked by an annoying warning from your browser that you can easily bypass.

Can they spy on your browsing, your passwords and such? Well, yes. But at least you were warned! (wags finger meaningfully). - If you choose not to accept the certificate and choose not to bypass the warning? Then you cannot use the free wifi. Many people would give up at this point and just allow it to happen. After all, you have to have your facebook and twitter. - Is there a third option? Depends. Some VPN clients can create a tunnel that is undecryptable by firewalls. Of course, such tunnels can also be blocked by policy at the firewall level as well. Your mileage may vary.

Let's go a bit deeper than that.

- The reason this works is because you are choosing to add an additional root certificate to your device at your discretion, when in reality there are already plenty of them, all not added at your discretion. My Windows 10 desktop has 31 root certificates trusted for me by Microsoft, who deems them worthy.

When you access a secure website you are trusting the procedures that all 31 organizations follow to ensure that the web server you are communicating with is actually who it says it is. There is an inherent web of trust that extends from you, the user, to the provider of your operating system or web browser, to the root certificate issuers, to their subordinate authorities, and finally to the web server that serves you the content. That's several layers that need to be airtight in their procedures, involving uncounted numbers of people or robots as is. Has any root certificate ever been removed from this list because it is unworthy of trust? Why, yes. it has happened, and quite recently as well. Check it out here: http://www.pcworld.com/article/3017157/security/microsoft-move-to-revoke-trust-in-20-root-certificates-could-wreak-havoc-on-sites.html https://techcrunch.com/2015/04/01/google-cnnic/

- Do Extended Validation certificates work?

We all see extended validation certificates on banking websites nowadays, they are the gold standard for issued certificates. The thing is, when should we see them and when should we not? Unless the user is able to expect an EV certificate, the entire exercise does seem to lose it's point.

- Is there any real point to the SSL certification process? This much is questionable. We know at least that American authorities are capable, and have been decrypting and collecting all transmissions that go through US routes, and perhaps more. Do they do so through a backdoor in TLS? This is not really known, and we venture into speculation at this point.

Finally, - Is there a viable alternative to the SSL/TLS certification system that we use every day? The answer to this is, in my opinion, no. It is better to encrypt, and block off the trivial "man in the middle" attacks, than no to encrypt and provide no protection at all. Better the broken system that we have than none at all, as we go further into the age of the internet.