Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why I stopped using StartSSL (Hint: it involves a Chinese company)

pierrekim.github.io

Post reply on HN
Print view View original

181–187 of 187 posts

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#181

Post by alvarosm »

tobltobs wrote: post #139
alvarosm wrote: post #133

Earlier quoted context omitted.

tobltobs: If you say I'm lying you should point out the falsehoods, or you're just another manipulator at work. At least pfg isn't arguing whether I'm telling the truth, he just has a different opinion.

> it forces you to keep a piece of software that can generate keys in your server. wrong, there are different ways to get a cert, even web interfaces, which you can install everywhere. > It forces you to reload your web server config every two months, unattended wrong, if you like that kind of work you can replace it by hand. > Because everyone should love to waste their time writing their own client. wrong, because…

Not wrong. You're forced to do all that if you don't want to spend inordinate amounts of money/time on maintaining the server. There are so many cheap certificates available -which are much simpler to use- that it's not worth the hassle, not by a long shot.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#182

Post by rsync »

pfg wrote: post #164
rsync wrote: post #161

Earlier quoted context omitted.

They do ? I had no idea. That sounds terrible. I have not implemented key-pinning myself, but I always assumed you were pinning the key of the actual site you were communicating with ... sort of like SSH ... That's not the case ?

You can pin to any of the public keys in your certificate chain, so that's the root cert, intermediate certs, or your own cert. Most deployments currently pin to a main and backup CA. This is because HPKP makes it fairly easy to essentially brick your domain (Think: Heartbleed and a lost backup key. Say goodbye to your domain!). It's possible, but you better know what you're doing.

Wow. So there's no way to simply say "here is the public key that I expect to see for this website, and alert me if it's different" ?

Isn't that the simplest thing with the most utility ?

What am I missing here ?

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#183

Post by pfg »

rsync wrote: post #182
pfg wrote: post #164

Earlier quoted context omitted.

You can pin to any of the public keys in your certificate chain, so that's the root cert, intermediate certs, or your own cert. Most deployments currently pin to a main and backup CA. This is because HPKP makes it fairly easy to essentially brick your domain (Think: Heartbleed and a lost backup key. Say goodbye to your domain!). It's possible, but you better know what you're doing.

Wow. So there's no way to simply say "here is the public key that I expect to see for this website, and alert me if it's different" ? Isn't that the simplest thing with the most utility ? What am I missing here ?

"any of the public keys in your certificate chain" includes your own certificate, so yes, that's possible.

However, if your main and backup key is lost or compromised, you have essentially bricked your domain. That's why most real-life deployments pin to two CAs instead (since CAs are generally better at managing keys).

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#184

Post by ca98am79 »

jaysoncena wrote: post #165
favadi wrote: post #110

Earlier quoted context omitted.

What's is their reason to block yours domains? They can't do that for no reason, right?

They do have a reason :) But paying them to remove our domains in the blacklist is a different issue.

congrats on making item 11111111

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#185

Post by happywolf »

cm2187 wrote: post #41
happywolf wrote: post #37

Earlier quoted context omitted.

Would like to add Baidu isn't better, too. Example, try search proprietary software, say 'Autocad', first few results are always pirate sites, while google will show the Autodesk site and the wikipedia post. Recently Baidu also under the spotlight for monetizing illness-related forums[1]. The issue is some patients accused the Internet giant selling their private info to _unqualified_ private hospitals. These hospita…

I imagine google is showing a global popularity vs popularity in China. A good search engine shows first the results that most people are really looking for...

What happens if that was your software? Will you think it is good? Hope whatever you have for a living is NOT up there for free due to 'popular demand'.

Re: Why I stopped using StartSSL (Hint: it involves a Chinese company)

#186

Post by happywolf »

chebum wrote: post #72
happywolf wrote: post #38

I had a bad experience with StartSSL using their free SSL cert. Basically they just treat you like a thief or scumbag trying to take advantage of their freebie. Eventually I found a company selling $10/year cert which I am happily paying. Now this adds another excuse for me to avoid StartSSL even more.

Opposite experience with their paid service. They respond quickly, even during the night.

No contradiction. It can treat paid customers as kings, but it doesn't mean non-paying customers are beggars and thieves.
Post reply on HN