Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Comodo fails to check CAA records

mail-archive.com

Post reply on HN
Print view View original

51–60 of 71 posts

Re: Comodo fails to check CAA records

#51

Post by geofft »

Panino wrote: post #26
koolba wrote: post #10

Earlier quoted context omitted.

They also voted "yes" to the proposal and had 6 months to implement it.

Exactly. For some contrast: I use tinydns, which doesn't natively support CAA records. But I wanted them so I read the CAA spec and wrote a little tool to add support for these records using the generic record format. And I'm not even a programmer! (I can write a little code, nothing serious, and nobody would hire me for it.) And yet with all of Comodo's resources, they couldn't get this done? I can't take them serio…

I'd assume that Comodo wrote the code, tested the code, deployed the code, and forgot to flip the switch to actually enable it in production.

Re: Comodo fails to check CAA records

#52

Post by geofft »

NelsonMinar wrote: post #31
chipperyman573 wrote: post #28

Earlier quoted context omitted.

>working with a malware company Why is this a bad thing? A cert says "Yes, person x REALLY IS person x, and I can prove it mathematically." It doesn't say "Person x is trustworthy enough for me to vouch for them."

Who do you imagine they verified was Person X? More on the malware cert issuance: https://blogs.msmvps.com/donna/2009/05/18/microsoft-mvp-mike... For malware concerns there's also Comodo's relationship with PrivDog. I'm not clear on whether PrivDog is deliberate malware or just incompetent insecure software.

> Who do you imagine they verified was Person X?

The legitimate owner of that domain or operator of the website. That's what certificates are supposed to attest to.

Malware authors might be bad people, but they're definitely people who exist in real life and have an identity that can be attested to.

Re: Comodo fails to check CAA records

#53

Post by agwa »

twothamendment wrote: post #50
agwa wrote: post #44

Earlier quoted context omitted.

You may find my CAA website helpful: https://sslmate.com/caa/support

I used your site - it was quick and easy. It soon went downhill from there. I don't run my own DNS or I'd be done pasting the line into my config. Instead I ran into a UI that doesn't support CAA as a type.

Unfortunately, if you want to use CAA your provider must support it. I recommend you use one of the DNS providers on the page I linked - there are quite a few to choose from.

Re: Comodo fails to check CAA records

#54

Post by hannob »

jf wrote: post #42

If this is the first time you've heard of CAA records, note that the "dig" command isn't yet aware of these records types, so you need to tell it to use "type257" as the record type: $ dig empty.basic.caatestsuite.com type257 More resources here: https://support.dnsimple.com/articles/caa-record/ https://caatestsuite.com/

The dig command is totally aware of it if you have updated bind within the past couple of years.

Re: Comodo fails to check CAA records

#55

Post by prdonahue »

tptacek wrote: post #34

If you're not already familiar with his work, you should know that Hanno Böck is a machine, and someone worth following. If there's some mistake you can make with the web PKI that is so stupid nobody would ever bother to check for it, rest assured that Hanno will eventually check.

Hanno also writes the Bulletproof TLS Newsletter (https://www.feistyduck.com/bulletproof-tls-newsletter/) which is highly informative. Suggest everyone interested in webPKI subscribe there as well.

Re: Comodo fails to check CAA records

#56

Post by 0xfeba »

NelsonMinar wrote: post #25

Wikipedia has a nice list of previous Comodo malfeasance: https://en.wikipedia.org/wiki/Comodo_Group#Controversies Highlights include allowing fraudulent certs to be issued for Google, Yahoo, and Mozilla; working with a malware company; and trademark shenanigans with Let's Encrypt.

The best one is their stupid Chromodo "Secure" Browser, that used --disable-web-security:

https://threatpost.com/chromodo-browser-disables-same-origin...

Re: Comodo fails to check CAA records

#57

Post by mike-cardwell »

jf wrote: post #42

If this is the first time you've heard of CAA records, note that the "dig" command isn't yet aware of these records types, so you need to tell it to use "type257" as the record type: $ dig empty.basic.caatestsuite.com type257 More resources here: https://support.dnsimple.com/articles/caa-record/ https://caatestsuite.com/

dig on Debian stable supports CAA just fine.

Re: Comodo fails to check CAA records

#58

Post by daenney »

twothamendment wrote: post #43

This inspired me to add a CAA record for my domain - but https://www.namecheap.com doesn't support that record type. Has anyone had better luck other places?

Have you tried their support flow? They've usually been very responsive in my experience, it might just be around the corner.

Re: Comodo fails to check CAA records

#59

Post by daenney »

wbl wrote: post #21
scaryclam wrote: post #12

Earlier quoted context omitted.

Revocation for being three days late in implementing a new standard would be a massive overreaction. It would harm thousands of businesses in the process and would be extremely petty. Symantecs misdeeds are far worse than this.

Revocation can be done only for new certs. It's time to throw a CA to the dogs once in a while pour encourage les autres.

Not at all. Revoke trust in the signing authority and all it's certificates turn invalid the second that change hits. Update your OS's trust store to not trust Comodo anymore and you'll see the effects immediately in IE/Edge on Windows or Safari and Chrome on macOS (Firefox still ships its own CA bundle).

It's just that when trust has been revoked in CAs recently, it's been done in a more gradual fashion to not hurt customers too much and give them time to migrate. After all, it's not the customer's fault the CA went rogue. This usually starts with not accepting certificates past a certain date but still validating previously issued ones, until sometime 6 months to a year later they're completely distrusted.

Re: Comodo fails to check CAA records

#60

Post by PappaPatat »

CAA is fresh like IPv10. Done some tracking the last couple of months on the alexa top 1 million domains. In April 400(!) had CAA records. In August 800. 10% have errors (the issuer-critical flag's value is set to 128, 4 6 or 9) where it should be either 0 or 1. iodef set to totally unusable web addressed, you name it. As a matter of fact there are MANY large DNS service providers that do not even bother providing CAA options. If you want to name and shame, there is ample opportunity for the years to come. Getting it up and running is harder but more rewarding in the end.
Post reply on HN