[cabfpub] China MITMing icloud.com

[Rich Smith]

Ben,

I agree that the exact wording you point out is correct, however, I think 360 Browser has shown that they do at least downgrade the browser chrome, and that they did publish warnings about this particular situation.  I agree completely with the other messages posted that their products current behavior is far from ideal and that they have significant work to do to make sure their users are secure, but in light of the screenshots they sent, and the articles they linked to which clearly show that they issued a warning about this, I withdraw any suggestion I made with respect to revocation of their Forum membership.  My hope is that their participation in the Forum and the feedback they get from this group will help them to significantly improve security for their users.

Regards,

Rich

 

From: Ben Laurie [mailto:benl at google.com] 
Sent: Wednesday, October 22, 2014 9:24 AM
To: richard.smith at comodo.com; 高寒蕊; public at cabforum.org
Cc: 石晓虹
Subject: Re: [cabfpub] China MITMing icloud.com

 

 

On Wed Oct 22 2014 at 2:17:15 PM Rich Smith <richard.smith at comodo.com> wrote:

Dear 360 Browser staff,

Thank you for this response.  As noted by others, I think your product needs some further work to be considered truly secure against these kinds of attacks, however I am glad to know that the original article's allegations seem to be unfounded.

 

The original article says "Internet users in China should first use a trusted browser on their desktops and mobile devices - Firefox <http://www.firefox.com.cn/>  and Chrome <https://en.greatfire.org/www.google.cn/chrome>  will both prevent users from accessing iCloud.com when they are trying to access a site that is suffering from a MITM attack. Qihoo’s popular Chinese 360 secure browser is anything but and will load the MITMed page directly."

which appears to be exactly what has been confirmed.

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/public/attachments/20141022/3ac6ef0e/attachment-0003.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 6378 bytes
Desc: not available
URL: <http://lists.cabforum.org/pipermail/public/attachments/20141022/3ac6ef0e/attachment-0003.bin>