Home / ubuntu / Questions

Questions[privacy](ubuntu)

Martin Hope
Pablo Bianchi
Asked: 2019-03-28 20:12:30 +0800 CST
  • 17

This article expose how around 18% of HTTPS connections are being detected as intercepted by MITM proxies. As the great related paper states:

To circumvent this validation, local software injects a self-signed CA certificate into the client browser’s root store at install time.
[...]
Contrary to widespread belief, public key pinning [19]— an HTTPS feature that allows websites to restrict connections to a specific key— does not prevent this interception. Chrome, Firefox, and Safari only enforce pinned keys when a certificate chain terminates in an authority shipped with the browser or operating system. The extra validation is skipped when the chain terminates in a locally installed root (i.e., a CA certificate installed by an administrator) [34].

Is pretty common on companies, desktop antivirus and malware/adware to add a root CA. Sometimes even with honest reasons. But to make the situation more clear: SSL web browsing is exactly as strong as the weakest CA (this includes DNS, if DNS-over-HTTPS).

I want to check if my HTTPS traffic is intercepted at least in three aspects (better if just with CLI):

So the real questions are:

  • How to list unofficially installed CA certificates (doesn't come with Ubuntu/Firefox/Chrome) to avoid MITM attacks/HTTPS interception?
  • How to reset trusted certificates stores to its default?

Some research and related questions

  • checkmyhttps seems old and not trustworthy

  • Chrome: chrome://settings/certificates.
    This is a subset of what return some of these commands?

    # System wide (I)
awk -v cmd='openssl x509 -noout -subject' '/BEGIN/{close(cmd)};{print | cmd}' < /etc/ssl/certs/ca-certificates.crt

# System wide (II) (`p11-kit` package)
trust list

  • Firefox

    certutil -L -d ~/.mozilla/firefox/*.default*/

  • I already sudo update-ca-certificates -v -f. This just updates without removing any sneaky already installed certificate?

Reference

security google-chrome ssl privacy certificates
Martin Hope
DaniCee
Asked: 2018-12-22 00:39:15 +0800 CST
  • 8

I am missing the Problem Reporting option in Privacy Settings, and I wanted to set it as manual. It was there when I installed Ubuntu, but now it's gone.

To clarify, I have Ubuntu 18.04 with the Pop theme and icons. The Problem Reporting option was there even after installing that theme.

Literally the only thing I did after a fresh install was following some of the steps in the following links; on one of the reboots, the option was gone forever.

Settings Screenshot

How can I get that option back?

settings privacy 18.04
Martin Hope
Federico Poloni
Asked: 2018-05-12 13:11:12 +0800 CST
  • 11

In order to set up Livepatch on Ubuntu 18.04, one needs to have a Ubuntu One account. Clearly this choice has privacy implications, and possibly also security ones (for instance, in theory, Canonical could choose to deploy malicious patches to one specific user only, and this would go undetected to the public).

Is the choice to require users to create an account purely a commercial choice, or is there a technical reason why an online account is needed, or more practical, to deploy these security patches? Is there anything in the Livepatch technology that could not be accomplished using purely .deb repositories?

ubuntu-one privacy online-accounts canonical-livepatch
Martin Hope
Dan Dman
Asked: 2012-05-12 09:33:44 +0800 CST
  • 47

After the recent upgrade to 12, I notice permanent connections to canonical servers.

Running netstat -tp gives:

Foreign Address         State       PID/Program name

mulberry.canonical:http CLOSE_WAIT  6537/ubuntu-geoip-p

alkes.canonical.co:http CLOSE_WAIT  6667/python     

alkes.canonical.co:http CLOSE_WAIT  6667/python

Why are there permanent connections and how could I stop this behavior?

And if this is intentional, who is responsible?

I would like to understand why this was done because to me it seems like a bad idea.

privacy scopes