SoylentNews is people
SoylentNews
Firefox browser-maker Mozilla is considering whether to block cybersecurity company DarkMatter from serving as one of its internet security gatekeepers after a Reuters report linked the United Arab Emirates-based firm to a cyber espionage program.
Reuters reported in January that DarkMatter provided staff for a secret hacking operation, codenamed Project Raven, on behalf of an Emirati intelligence agency. The unit was largely comprised of former U.S. intelligence officials who conducted offensive cyber operations for the UAE government.
Former Raven operatives told Reuters that many DarkMatter executives were unaware of the secretive program, which operated from a converted Abu Dhabi mansion away from DarkMatter’s headquarters.
Those operations included hacking into the internet accounts of human rights activists, journalists and officials from rival governments, Reuters found. DarkMatter has denied conducting the operations and says it focuses on protecting computer networks.
[...] DarkMatter has been pushing Mozilla for full authority to grant certifications since 2017, the browser maker told Reuters. That would take it to a new level, making it one of fewer than 60 core gatekeepers for the hundreds of millions of Firefox users around the world.
[Selena] Deckelmann said Mozilla is worried that DarkMatter could use the authority to issue certificates to hackers impersonating real websites, like banks.
As a certification authority, DarkMatter would be partially responsible for encryption between websites they approve and their users.
In the wrong hands, the certification role could allow the interception of encrypted web traffic, security experts say.
In the past Mozilla has relied exclusively on technical issues when deciding whether to trust a company with certification authority.
The Reuters investigation has led it to reconsider its policy for approving applicants. “You look at the facts of the matter, the sources that came out, it’s a compelling case,” said Deckelmann.
Previously: Surveillance Firm Asks Mozilla to be Included in Firefox's Certificate Whitelist
(Score: 0) by Anonymous Coward on Wednesday March 06 2019, @05:38PM
Every company is under coercion by the government of every nation in which it operates. The employees may even be forced to secretly act against the company, if they aren't wholeheartedly in support of that already.
This includes every company issuing certificates, domain names, or IP address space. It includes the countries in which web servers are physically located. It includes the countries where the web developers work, and their countries of citizenship.
The proper rule is simple: instead of the locked-lock icon for web site security, display the flag of every country which you'd need to trust.
Some of that is hopelessly difficult, for example all the dual citizenship of all Google employees. The basics are not too bad. We know where companies are incorporated and headquartered. Use that.
So if a UAE certificate is found on a French domain with a US IP address, display those flags: UAE, US, France. It becomes clear that you must trust all 3 if you are to trust the web site.
Make the indicator flash, with a bright red border, if there is more than one country. Web sites shouldn't be increasing their security risk by involving extra countries.