Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why I stopped using StartSSL (Hint: it involves a Chinese company)

pierrekim.github.io

Post reply on HN
Print view View original

121–130 of 187 posts

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#121

Post by blfr »

alvarosm wrote: post #119

Pathetic let'sencrypt promotion. Now I'm gonna give you a few reasons not to use let's encrypt: it forces you to keep a piece of software that can generate keys in your server. It forces you to reload your web server config every two months, unattended (they won't issue certs valid for more than 90 days). The alernative would be to do the process manually every two months(wtf?). Also, its certificates are not trusted…

It does not force you to use any particular software. You can even write your own client.

Shorter validity time makes your users safer. If you lose the private key, it will only be a problem for three monts or less. Reloading your webserver should be a complete non-issue.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#122

Post by alvarosm »

alvarosm wrote: post #119

Pathetic let'sencrypt promotion. Now I'm gonna give you a few reasons not to use let's encrypt: it forces you to keep a piece of software that can generate keys in your server. It forces you to reload your web server config every two months, unattended (they won't issue certs valid for more than 90 days). The alernative would be to do the process manually every two months(wtf?). Also, its certificates are not trusted…

Downvote the truth, keep them coming. I'm used to censorship in HN.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#123

Post by pfg »

maggit wrote: post #112
hannob wrote: post #79

The author doesn't explain at all why he thinks that not using StartSSL solves any problem. This indicates a major and common misunderstanding of how certificates and PKI work. Essentially it doesn't matter which Certificate Authority you use for security reasons - because any CA can attack you, whether you're their customer or not. This can only be mitigated by using key pinning (hpkp), but then - at least if you pi…

Can you pin leaf certificates? Quoting https://developer.mozilla.org/en/docs/Web/Security/Public_Ke... : > Firefox (and Chrome) disable Pin Validation for Pinned Hosts whose validated certificate chain terminates at a user-defined trust anchor (rather than a built-in trust anchor). I understand this as "when using HPKP, you have to pin a CA certificate, not your site's leaf certificate". If this understanding is corr…

It's my understanding that you can pin to any certificate in your chain, but if a server presents a certificate that leads to a user-defined trust anchor (i.e. your typical corporate MitM proxy cert), no HPKP check is performed.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#124

Post by alvarosm »

blfr wrote: post #121
alvarosm wrote: post #119

Pathetic let'sencrypt promotion. Now I'm gonna give you a few reasons not to use let's encrypt: it forces you to keep a piece of software that can generate keys in your server. It forces you to reload your web server config every two months, unattended (they won't issue certs valid for more than 90 days). The alernative would be to do the process manually every two months(wtf?). Also, its certificates are not trusted…

It does not force you to use any particular software. You can even write your own client. Shorter validity time makes your users safer. If you lose the private key, it will only be a problem for three monts or less. Reloading your webserver should be a complete non-issue.

Because everyone should love to waste their time writing their own client. And running let'sencrypt scripts as root. And risking their security. And/or renewing certificates every now and then instead of focusing on stuff that matters. And anyone who disagreees should be downvoted to oblivion. YEAH!

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#125

Post by malka »

tombrossman wrote: post #83
Tepix wrote: post #53

Quote from the article: "StartSSL already refused to revoke certificates affected by the HeartBleed vulnerability and accused the user from negligence." That's wrong. They did charge a $25 fee for the revocation, however. I think it's reasonable since there is probably some manual process involved and the certificate was already free. They have to earn money somehow.

Exactly, they've automated the issuance of free certs and revoking takes extra work. $25 sounds high (sub-$10/year certs with unlimited free revocation & re-issuance are easy to find) so it is a money maker for them but so what? People think nothing of using the freemium model which gives you a basic product for free, and charges you for extra features. It's exactly what StartSSL are doing here. I don't particularly…

Except that it causes that a startSSL certificate had a higher chance of being unrevoked if compromised. Therefore, I remove them from the truststore on my computers.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#126

Post by StavrosK »

mfjordvald wrote: post #11

Why anything to do with Qihoo is worrying: https://en.greatfire.org/blog/2014/oct/china-collecting-appl... It's proven in the past that they're not a security company for anything that deals with protecting yourself against snooping by the Chinese state and will negatively affect your security. Seeing this in relation to free SSL intended to be deployed all over the internet. Yeah, that is worrying.

Looks like we can't win, since most companies are being snooped by someone. There's hardly a service I use that's not within the NSA's reach, for example, and China is probably less dangerous to me than the US.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#127

Post by blfr »

alvarosm wrote: post #124
blfr wrote: post #121

Earlier quoted context omitted.

It does not force you to use any particular software. You can even write your own client. Shorter validity time makes your users safer. If you lose the private key, it will only be a problem for three monts or less. Reloading your webserver should be a complete non-issue.

Because everyone should love to waste their time writing their own client. And running let'sencrypt scripts as root. And risking their security. And/or renewing certificates every now and then instead of focusing on stuff that matters. And anyone who disagreees should be downvoted to oblivion. YEAH!

I'm quite happy with simp_le[1] which doesn't require root. Renewals can happen automatically. All you need to do is monitor your certificates as you would anyway.

[1] https://github.com/kuba/simp_le

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#128

Post by icebraining »

josteink wrote: post #69
bjacobel wrote: post #3

There's really not much reason to use StartSSL now that Let's Encrypt, AWS Certificate Manager and others offer free certs with vastly better support, tooling and interfaces.

> There's really not much reason to use StartSSL now that Let's Encrypt Have you tried using it? On every domain I've tried to obtain a cert it has failed. For me StartSSL may be suboptimal, but at least it works, which is more than I can say for Letsencrypt in its current state.

What client did you use? acme-tiny has been flawless for me, though it's more manual than the main client.

https://github.com/diafygi/acme-tiny

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#129

Post by pfg »

alvarosm wrote: post #124
blfr wrote: post #121

Earlier quoted context omitted.

It does not force you to use any particular software. You can even write your own client. Shorter validity time makes your users safer. If you lose the private key, it will only be a problem for three monts or less. Reloading your webserver should be a complete non-issue.

Because everyone should love to waste their time writing their own client. And running let'sencrypt scripts as root. And risking their security. And/or renewing certificates every now and then instead of focusing on stuff that matters. And anyone who disagreees should be downvoted to oblivion. YEAH!

You don't have to run anything as root if you don't want to. There are tons of clients out there without that requirement. Your argument is basically that Let's Encrypt should have put more focus on working like other CAs do, while they decided to focus on better security and automation. Luckily, there are plenty of other CAs out there, and it's quite likely that more of them will start offering free DV certs soon, so it's not like Let's Encrypt is forcing you to do anything you don't want to.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#130

Post by tobltobs »

alvarosm wrote: post #124
blfr wrote: post #121

Earlier quoted context omitted.

It does not force you to use any particular software. You can even write your own client. Shorter validity time makes your users safer. If you lose the private key, it will only be a problem for three monts or less. Reloading your webserver should be a complete non-issue.

Because everyone should love to waste their time writing their own client. And running let'sencrypt scripts as root. And risking their security. And/or renewing certificates every now and then instead of focusing on stuff that matters. And anyone who disagreees should be downvoted to oblivion. YEAH!

You are not getting downvoted for a different opinion, but for false statements.
Post reply on HN