11–20 of 255 posts
SSL is fundamentally broken. Web-of-trust is the only real way to do security.
SSL is fundamentally broken. Web-of-trust is the only real way to do security.
You're assuming that random people on the internet are going to collectively be more secure than CAs, which is obviously not the case.
Imagine you get an email signed by the IRS, and which is trusted by people A1, A2 and A3, who are trusted by people B1, B2, and B3 ... who are trusted by Z1, Z2, and Z3, who are fully trusted by you.
Should be reliable, right?
But while Z1, Z2 and Z3 may keep all OPSEC rules, you have no guarantee that they verified that Y1, Y2 and Y3 did. And even if they did, you have no guarantee that ...
And even if you did, can you guarantee that no one there got any malware, which signed off on a bunch of fake certs?
https://www.trustico.com/ssltools/create/csr-pem/create-a-ne...
Apparently they decided to keep a copy of the private key.
Edit: Looks like they are having problems atm. A copy can be found at
https://web.archive.org/web/20180217071027/https://www.trust...
The thing that isn’t clear to me is how Trustico even had the private keys to begin with. It’s been a while since I’ve purchased a SSL certificate, but I remember generating the private key locally and providing a certificate signing request, which isn’t the private key. What am I misunderstanding here?
You remember correctly the way things should happen. But, presumably, Trustco generated the public and private keys for the customers, signed the certificates, and handed the whole mess to the customers. I imagine some customers would even pay a bit more to not have to bother learning to generate a keypair and signing request themselves. The thing I don't understand is how the CEO thought things would likely work out…
EDIT: From Trustico's account
> We believe the orders placed via our Symantec account were at risk and were poorly managed. We have been questioning Symantec without response as to concerning items for about a year. Symantec simply ignored our concerns and appeared to bury them under the next issue that arose... We were also a victim whereby Symantec mis-issued SSL Certificates owned by us, subsequently we were asked to keep the matter quiet, under a confidentially notice.
https://groups.google.com/d/msg/mozilla.dev.security.policy/...
SSL is fundamentally broken. Web-of-trust is the only real way to do security.
Oh, it's worse than that: https://twitter.com/svblxyz/status/969220402768736258 You can run arbitrary shell commands as root from their webserver.
SSL is fundamentally broken. Web-of-trust is the only real way to do security.
Oh, it's worse than that: https://twitter.com/svblxyz/status/969220402768736258 You can run arbitrary shell commands as root from their webserver.
The thing that isn’t clear to me is how Trustico even had the private keys to begin with. It’s been a while since I’ve purchased a SSL certificate, but I remember generating the private key locally and providing a certificate signing request, which isn’t the private key. What am I misunderstanding here?
"Trustico allows customers to generate a Certificate Signing Request and Private Key during the ordering process," the statement read. "These Private Keys are stored in cold storage, for the purpose of revocation." Maybe they decided preparing CSR is too hard for their clients :/
The idea that the company would store the private keys, however, is even more troubling.
Oh, it's worse than that: https://twitter.com/svblxyz/status/969220402768736258 You can run arbitrary shell commands as root from their webserver.