Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why I stopped using StartSSL (Hint: it involves a Chinese company)

pierrekim.github.io

Post reply on HN
Print view View original

71–80 of 187 posts

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#71

Post by Laforet »

thesimon wrote: post #33
ars wrote: post #21

Earlier quoted context omitted.

I got downmodded before for saying this, but I still feel this way: Automating this simply means that if someone hacks your machine, they also have full access to generate any certs they like. I don't consider this a positive thing. You can separate the generation onto another machine, but it's much more complicated, and the default install is not that way. I have yet to hear any useful reason to rotate the key.

>Automating this simply means that if someone hacks your machine, they also have full access to generate any certs they like. Well, they can generate certs for your domain. But what exactly is the big difference between generating a new certificate for your domain and having your private key. I fail to see why it would be a huge risk, they can access all your users data in any case. >I have yet to hear any useful rea…

A short validity period also helps to keep the size of revocation lists manageable as they expire sooner.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#72

Post by chebum »

happywolf wrote: post #38

I had a bad experience with StartSSL using their free SSL cert. Basically they just treat you like a thief or scumbag trying to take advantage of their freebie. Eventually I found a company selling $10/year cert which I am happily paying. Now this adds another excuse for me to avoid StartSSL even more.

Opposite experience with their paid service. They respond quickly, even during the night.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#73

Post by HappyTypist »

cm2187 wrote: post #41
happywolf wrote: post #37

Earlier quoted context omitted.

Would like to add Baidu isn't better, too. Example, try search proprietary software, say 'Autocad', first few results are always pirate sites, while google will show the Autodesk site and the wikipedia post. Recently Baidu also under the spotlight for monetizing illness-related forums[1]. The issue is some patients accused the Internet giant selling their private info to _unqualified_ private hospitals. These hospita…

I imagine google is showing a global popularity vs popularity in China. A good search engine shows first the results that most people are really looking for...

Exactly. This is actually an example of Baidu having objectively better results.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#74

Post by jgrahamc »

mmaunder wrote: post #51
jgrahamc wrote: post #40

Earlier quoted context omitted.

Nope. Your "understanding" is completely wrong. CloudFlare's network in China does not contain configuration, settings, SSL certificates etc. from non-China CloudFlare customers. We run separate infrastructure there and only if you go through the hoops to expose your web site on our network inside China do we send information about your web site there. Source: me (I'm CloudFlare's CTO)

Not that wrong. You're just saying you have to enable China. Do you make it clear in the UI that a private key is ending up on Baidu's servers operated by Baidu's people? I don't use CF so I don't know - I'm just curious what the user experience is like. I'm asking because your CEO addressed concerns in the CNBC article about Baidu having access to your intellectual property so they seem to have full access. I think…

We don't offer SSL in China.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#75

Post by HappyTypist »

mmaunder wrote: post #51
jgrahamc wrote: post #40

Earlier quoted context omitted.

Nope. Your "understanding" is completely wrong. CloudFlare's network in China does not contain configuration, settings, SSL certificates etc. from non-China CloudFlare customers. We run separate infrastructure there and only if you go through the hoops to expose your web site on our network inside China do we send information about your web site there. Source: me (I'm CloudFlare's CTO)

Not that wrong. You're just saying you have to enable China. Do you make it clear in the UI that a private key is ending up on Baidu's servers operated by Baidu's people? I don't use CF so I don't know - I'm just curious what the user experience is like. I'm asking because your CEO addressed concerns in the CNBC article about Baidu having access to your intellectual property so they seem to have full access. I think…

It's opt in.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#76

Post by est »

jgrahamc wrote: post #74
mmaunder wrote: post #51

Earlier quoted context omitted.

Not that wrong. You're just saying you have to enable China. Do you make it clear in the UI that a private key is ending up on Baidu's servers operated by Baidu's people? I don't use CF so I don't know - I'm just curious what the user experience is like. I'm asking because your CEO addressed concerns in the CNBC article about Baidu having access to your intellectual property so they seem to have full access. I think…

We don't offer SSL in China.

Please do, ISP hijack is rampant in China, even Baidu, Taobao, Tmall, etc. added full site SSL.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#78

Post by ascorbic »

josteink wrote: post #67
ascorbic wrote: post #36

Earlier quoted context omitted.

StartSSL has some of the worst support I've ever encountered. Normally bad support means clueless or non-responsive. However StartSSL support is often actively hostile, treating customers as idiots or worse. I should point out that this isn't always the case, and I have used them in the past without trouble, but the times when it is bad are bad enough to write them off. Their site also looks like it was made in 1998,…

> while using client certificates is secure and everything, it's also seriously user-hostile. I have to remember which computer and browser I used a year ago to sign up? Yeah, I know I should back up client certificates, but seriously who does that? So you want a secure website, and you agree that SSL is needed for things to be secure. But you're not willing to put in one inch of effort yourself to secure your own SS…

So every other CA in the world is doing it half-assed? I'm not aware of any others that require client certs to access the site.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#79

Post by hannob »

The author doesn't explain at all why he thinks that not using StartSSL solves any problem. This indicates a major and common misunderstanding of how certificates and PKI work.

Essentially it doesn't matter which Certificate Authority you use for security reasons - because any CA can attack you, whether you're their customer or not. This can only be mitigated by using key pinning (hpkp), but then - at least if you pin leaf certificates - it still doesn't matter which CA you choose.

Every text that indicates "I don't trust CA X for reason Y, therefore I don't use them" is based on a misunderstanding of how certificates work.

(And yes - I know that there is the issue that you can let StartSSL create the private key for you. Just don't do this ever, no matter which CA you use.)

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#80

Post by blfr »

hannob wrote: post #79

The author doesn't explain at all why he thinks that not using StartSSL solves any problem. This indicates a major and common misunderstanding of how certificates and PKI work. Essentially it doesn't matter which Certificate Authority you use for security reasons - because any CA can attack you, whether you're their customer or not. This can only be mitigated by using key pinning (hpkp), but then - at least if you pi…

Well, you could pin your CA's certificate so at the very least your repeat users won't be at risk but fundamentally you're right and it is a common misconception.
Post reply on HN