Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why I stopped using StartSSL (Hint: it involves a Chinese company)

pierrekim.github.io

Post reply on HN
Print view View original

161–170 of 187 posts

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#161

Post by rsync »

tptacek wrote: post #118
hannob wrote: post #79

The author doesn't explain at all why he thinks that not using StartSSL solves any problem. This indicates a major and common misunderstanding of how certificates and PKI work. Essentially it doesn't matter which Certificate Authority you use for security reasons - because any CA can attack you, whether you're their customer or not. This can only be mitigated by using key pinning (hpkp), but then - at least if you pi…

Since a pretty typical HPKP configuration pins to CAs, this seems like bad advice.

They do ? I had no idea. That sounds terrible.

I have not implemented key-pinning myself, but I always assumed you were pinning the key of the actual site you were communicating with ... sort of like SSH ...

That's not the case ?

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#162

Post by sandGorgon »

imron wrote: post #55
sandGorgon wrote: post #17

Earlier quoted context omitted.

can you explain this ? I'm trying to bake letsencrypt certificates in my docker images and I am trying to figure out a way around the race condition (nginx needs a certificate to run certificate needs nginx to run).

How about storing the letsencrypt certificates in a data-container/locally on the host and mapping those files to the nginx container when you start it? For the very first time, you can use let's encrypt's manual verification process, but then have the let's encrypt client set up to renew certs automatically (possibly even from a separate container) using same data file mappings.

which is why im preferring to spend 10$ on a certificate instead (or rather 85$ for a wildcard).

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#163

Post by sandGorgon »

vacri wrote: post #63
sandGorgon wrote: post #17

Earlier quoted context omitted.

can you explain this ? I'm trying to bake letsencrypt certificates in my docker images and I am trying to figure out a way around the race condition (nginx needs a certificate to run certificate needs nginx to run).

As a totally-naive-to-your-problem-particulars and totally-hacky suggestion, why not start nginx with a starter cert, then mv the new cert into position and reload nginx?

exactly what I did - but then I bought a certificate from rapidssl for 10 bucks...

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#164

Post by pfg »

rsync wrote: post #161
tptacek wrote: post #118

Earlier quoted context omitted.

Since a pretty typical HPKP configuration pins to CAs, this seems like bad advice.

They do ? I had no idea. That sounds terrible. I have not implemented key-pinning myself, but I always assumed you were pinning the key of the actual site you were communicating with ... sort of like SSH ... That's not the case ?

You can pin to any of the public keys in your certificate chain, so that's the root cert, intermediate certs, or your own cert.

Most deployments currently pin to a main and backup CA. This is because HPKP makes it fairly easy to essentially brick your domain (Think: Heartbleed and a lost backup key. Say goodbye to your domain!). It's possible, but you better know what you're doing.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#165

Post by jaysoncena »

favadi wrote: post #110
jaysoncena wrote: post #94

Earlier quoted context omitted.

I've worked with a company that at least 30% of our user base uses Qihoo brower. They blocked few of our domains and now, someone from Qihoo asked us to pay so that they will unblock our domains.

What's is their reason to block yours domains? They can't do that for no reason, right?

They do have a reason :) But paying them to remove our domains in the blacklist is a different issue.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#167

Post by dragonwriter »

vidoc wrote: post #166

Funny how 'China' has replaced 'Russia' in being the SingleAndUltimateEvilEnemyOfTheFreeWorld in the poorly informed mind of some.

I thought that role had been taken by al-Qaeda, and recently succeeded by "ISIS".

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#168

Post by Spivak »

hannob wrote: post #79

The author doesn't explain at all why he thinks that not using StartSSL solves any problem. This indicates a major and common misunderstanding of how certificates and PKI work. Essentially it doesn't matter which Certificate Authority you use for security reasons - because any CA can attack you, whether you're their customer or not. This can only be mitigated by using key pinning (hpkp), but then - at least if you pi…

> "I don't trust CA X for reason Y, therefore I don't use them" is based on a misunderstanding of how certificates work.

I don't think so. If you don't trust a particular CA then you shouldn't in good conscience make trusting them a requirement to access your services. And by using an untrustworthy CA you are making it harder for browsers and distribution maintainers to distrust them if they start abusing that trust.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#169

Post by vidoc »

dragonwriter wrote: post #167
vidoc wrote: post #166

Funny how 'China' has replaced 'Russia' in being the SingleAndUltimateEvilEnemyOfTheFreeWorld in the poorly informed mind of some.

I thought that role had been taken by al-Qaeda, and recently succeeded by "ISIS".

It's true, but they aren't usually portrayed as being smart, just crazy/ugly/stupid. Whereas Chinese and Russians are portrayed as being extremely smart and cold hearted.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#170

Post by vidoc »

vidoc wrote: post #169
dragonwriter wrote: post #167

Earlier quoted context omitted.

I thought that role had been taken by al-Qaeda, and recently succeeded by "ISIS".

It's true, but they aren't usually portrayed as being smart, just crazy/ugly/stupid. Whereas Chinese and Russians are portrayed as being extremely smart and cold hearted.

Of course never as smart since as Marco Rubio says "it is the greatest nation in the history of Mankind" no less ..
Post reply on HN