<div dir="ltr"><div><div><div>Hi,<br><br></div>This is a guess and just a guess: The Ministry of Finance/France installed an SSL Proxy to inspect all SSL traffic (read: spy on its employees). (Google hopefully will release more infos of how they found out about the cert)<br>
<br>Spying on employees is illegal under EU law (in general) regardless if the employee agrees to it in the employment contract or not. (Unless under certain circumstances. I do not know if they were met here. The EU Comission is the right body to investigate this).<br>
<br></div>The quote from the ANSSI statement does not make sense (technically) and looks like a failed PR attempt.<br></div><div><br>regards,<br><br>skyper<br><div><br></div></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">
On Tue, Dec 10, 2013 at 11:34 AM, Larry Seltzer <span dir="ltr"><<a href="mailto:larry@larryseltzer.com" target="_blank">larry@larryseltzer.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div link="blue" vlink="purple" lang="EN-US">
<div>
<p class="MsoNormal">ANSSI responded several days ago (<a href="http://www.ssi.gouv.fr/en/the-anssi/events/revocation-of-an-igc-a-branch-808.html" target="_blank">http://www.ssi.gouv.fr/en/the-anssi/events/revocation-of-an-igc-a-branch-808.html</a>), but someone’s going to
have to explain to me how their explanation is possible:<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">“<span style="background:#f3f7f1;font-size:10.0pt;font-family:"Arial","sans-serif"">As a result of a human error which was made during a process aimed at strengthening the overall IT security of the French Ministry of Finance,
digital certificates related to third-party domains which do not belong to the French administration have been signed by a certification authority of the DGTrésor (Treasury) which is attached to the IGC/A.</span>”<span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">I can maybe understand how an intermediate CA cert was made as part of some test, but using it to sign <a href="http://foo.google.com" target="_blank">foo.google.com</a> or whatever, and putting all this online…
Someone make this clearer for me<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Arial","sans-serif";color:#1f497d;background:white">Larry J Seltzer<br>
</span></b><span style="font-size:11.0pt;font-family:"Arial","sans-serif";color:#1f497d;background:white"><a href="mailto:larry@larryseltzer.com" target="_blank">larry@larryseltzer.com</a><br>
</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d;background:white"><a href="tel:%28973%29%20378-8728" value="+19733788728" target="_blank">(973) 378-8728</a>
<br>
Follow Me On Twitter: @lseltzer</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u><u></u></span></p><div class="im">
<div>
<div>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><u></u> <u></u></p>
<div>
<p class="MsoNormal">On Sat, Dec 7, 2013 at 10:05 PM, Seth Schoen <<a href="mailto:schoen@eff.org" target="_blank">schoen@eff.org</a>> wrote:<u></u><u></u></p>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal"><a href="http://googleonlinesecurity.blogspot.com/2013/12/further-improving-digital-certificate.html" target="_blank">http://googleonlinesecurity.blogspot.com/2013/12/further-improving-digital-certificate.html</a><br>
<br>
They caught it with pinning. I wonder if we have a sample; it sounds<br>
like it was an extremely small-scale attack (a single organization got<br>
an intermediate chaining to a publicly-trusted root in order to spy on<br>
employees with its firewall?). If that was the entire scope of it,<br>
it's relatively unlikely that anyone in that organization is sending<br>
observations to us, maybe depending on how large the organization is<br>
and whether they prevent desktop users from installing third-party<br>
software.<br>
<span style="color:#888888"><br>
--<br>
Seth Schoen <<a href="mailto:schoen@eff.org" target="_blank">schoen@eff.org</a>><br>
Senior Staff Technologist <a href="https://www.eff.org/" target="_blank">
https://www.eff.org/</a><br>
Electronic Frontier Foundation <a href="https://www.eff.org/join" target="_blank">https://www.eff.org/join</a><br>
815 Eddy Street, San Francisco, CA 94109 <a href="tel:%2B1%20415%20436%209333%20x107" target="_blank">
+1 415 436 9333 x107</a></span><u></u><u></u></p>
</blockquote>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div></div>
</div>
</blockquote></div><br></div>