11–20 of 187 posts
It's proven in the past that they're not a security company for anything that deals with protecting yourself against snooping by the Chinese state and will negatively affect your security.
Seeing this in relation to free SSL intended to be deployed all over the internet. Yeah, that is worrying.
The author doesn't say why this is worrisome. He just says he's worried "that the PKI front-end (auth.startssl.com) is now hosted within a Chinese Antivirus Company, who uses a Chinese ISP for 2 months and that there hasn't been any news around". The article could certainly use a bit more connecting-the-dots to show how he gets from "they're hosted in China" to "I won't use them anymore".
The author doesn't say why this is worrisome. He just says he's worried "that the PKI front-end (auth.startssl.com) is now hosted within a Chinese Antivirus Company, who uses a Chinese ISP for 2 months and that there hasn't been any news around". The article could certainly use a bit more connecting-the-dots to show how he gets from "they're hosted in China" to "I won't use them anymore".
I think the implication is that the Chinese government exerts a lot of control over the internet there, and are openly monitoring/intercepting internet traffic. As such, they shouldn't be considered a trusted authority for security related purposes.
Most software that uses TLS nowadays ships with a number of CA root certs sponsored by various nation states including China. On desktop they can be disabled but iOS drvices are out of luck (or perpetually compromised in a sense)
a. they labeled their own browser as a Microsoft security update, which triggered MS investigation
b. they cheated on the anti-virus lab testing and got banned. ....etc.
Earlier quoted context omitted.
I think the implication is that the Chinese government exerts a lot of control over the internet there, and are openly monitoring/intercepting internet traffic. As such, they shouldn't be considered a trusted authority for security related purposes.
Your concern is well placed but the linked post really missed the point. Signing authorities in X509 don't have access to private keys and they don't really need domain owner's input to sign a MITM cert. Most software that uses TLS nowadays ships with a number of CA root certs sponsored by various nation states including China. On desktop they can be disabled but iOS drvices are out of luck (or perpetually compromise…
Earlier quoted context omitted.
When I can use Let's Encrypt to get a certificate in production without running anything on my production web server, I'll consider it. Right now, StartSSL validates my domain via email and I only have to touch it once a year, not once every 3 months like Let's Encrypt.
I use Let's Encrypt DNS validation. This does not require you to run anything on your server. You just need to have a way to distribute cert to your servers.
Earlier quoted context omitted.
Your concern is well placed but the linked post really missed the point. Signing authorities in X509 don't have access to private keys and they don't really need domain owner's input to sign a MITM cert. Most software that uses TLS nowadays ships with a number of CA root certs sponsored by various nation states including China. On desktop they can be disabled but iOS drvices are out of luck (or perpetually compromise…
By default, StartSSL's wizard generates private keys for you. (Providing your own key is of course an option).
Chinese company is not a red flag. but Qihoo is. The company has known bad reputation. a. they labeled their own browser as a Microsoft security update, which triggered MS investigation b. they cheated on the anti-virus lab testing and got banned. ....etc.
Earlier quoted context omitted.
I use Let's Encrypt DNS validation. This does not require you to run anything on your server. You just need to have a way to distribute cert to your servers.
can you explain this ? I'm trying to bake letsencrypt certificates in my docker images and I am trying to figure out a way around the race condition (nginx needs a certificate to run certificate needs nginx to run).