Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Lately I've been getting a lot of warnings about SSL certifications on my pc, Empathy keeps telling me that Facebook's certificate is self-signed and can't be trusted, and also, there are occasional warnings in Google-Chrome about security. I remember the last one saying that that the page is secured but some of the resources that the page is using are not from a secure connection, something like that.

Is my pc hacked / under attack? How can I check that, and if so, how can I safeguard myself?

PS: One thing that comes to my mind is that I might be under an arp poisoning / spoofing attack.

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

I don't think that you are under attack.

When it comes to trusting certificates, one has to know that a certificate is trusted if it is signed by another authority's certificate / key, when the other authority's certificates / keys which are used for signing already are trusted. That is the so-called "chain of trust"; you may have heard this term already.

Now, every chain needs a begin. Practically, that means that for example a browser has some root certificates in it. These are hardcoded, and it is a gold mine for every company that manages to get it's own certificates hardcoded into browsers; in few moments, you will see why.

When a browser checks a certificate from a website A, it does basically the following:

  • Check if the certificate is one of the root certificates
  • If not, check if the certificate is signed by a root certificate
  • If not, check if the certificate is signed by a certificate which is signed by a root certificate

... and so on. I am deliberately simplifying the situation and partly using slightly incorrect terms (actually, we talk about hashes, private and public keys and so on), but the principle should be clear now.

Regarding your question: I suspect that your software just hasn't these root certificates. You could easily test this by using other software. For example, try Firefox in case of websites; if Firefox also shows warnings, it may be dangerous.

Furthermore, certificates generally expire, and people may forget to renew them. This may happen even to the largest companies, as history has shown. Browsers and other software will issue warnings due to expired certificates. Last, certificates can be revoked; for example, if a criminal company manages to get a certificate which is signed by one of the well-known root certificates, for example a certificate from Verisign or such, then the certificate of that company has to be rendered invalid as soon as the company's criminal actions are known.

So my advice would be to test with other browsers and to open the certificate and check the reason for distrusting - any solid software will show it.

Regarding your other warning, there is no general advice. It can happen that parts of one single web document are secured and other parts are not. That is a fact we have to live with (showing the reasons going far beyond this post); the problem in this case is that you can't easily find out if it is the advertisement which is not secured or if it is your credit card number which is not secured.

If I contradict myself and give you a general advice: When giving the website personal information which could be abused in any way, I would leave it. Such mistakes let you see how serious a company takes its obligations for securing customers' personal data.

Regards,

Binarus

share|improve this answer
    
Do you really think Facebook would use certificates that didn't chain to a browser-included root? They know that if they don't do it right, they scare their user base. –  Matthew Flaschen Mar 26 '12 at 21:43
add comment

Yep, someone is attacking you. View this firefox bug-report of someone who had the same problem as you: https://bugzilla.mozilla.org/show_bug.cgi?id=460374

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.