51–60 of 255 posts
Oh, it's worse than that: https://twitter.com/svblxyz/status/969220402768736258 You can run arbitrary shell commands as root from their webserver.
Welcome to the future of computers where security comes secondary to extra profits and marketing.
Let's Encrypt shut down their new test interface because of a security flaw they found. If this was in a production service, this would have been about as bad of a security flaw as is possible in a PKI system.
Let's not get all high and mighty assuming Let's Encrypt won't get compromised; they probably will. We should be planning for how to deal with that.
They have a tool that allows you create a private key + CSR https://www.trustico.com/ssltools/create/csr-pem/create-a-ne... Apparently they decided to keep a copy of the private key. Edit: Looks like they are having problems atm. A copy can be found at https://web.archive.org/web/20180217071027/https://www.trust...
StartSSL used it, for example, but also allowed you to hand them a CSR of your own making. Although they of course ignored almost everything in the CSR apart from the public key (which is probably a good idea).
(1) IIRC you could even have a smartcard generate the key, at least in theory.
HN discussion: https://news.ycombinator.com/item?id=16485801
They have a tool that allows you create a private key + CSR https://www.trustico.com/ssltools/create/csr-pem/create-a-ne... Apparently they decided to keep a copy of the private key. Edit: Looks like they are having problems atm. A copy can be found at https://web.archive.org/web/20180217071027/https://www.trust...
This probably happened because they allowed users to execute root commands on their server. Either they quickly shut down the site or someone else did it by shutting down some servers. > https://twitter.com/svblxyz/status/969220402768736258
Perhaps they’re passing this command to a secured container? I shouldn’t make excuses for them, but passing root commands to the shell seems too far out there.
letsencrypt is great and I use it. But I don't really get it. All I needed to do was prove that I could place a generated file on the server that I wanted the certificate for. This seems to me to be a very low bar. What am I missing?
They're not verifying your identity, just that you control the hardware running the domain that you want to generate a certificate for.
Earlier quoted context omitted.
You remember correctly the way things should happen. But, presumably, Trustco generated the public and private keys for the customers, signed the certificates, and handed the whole mess to the customers. I imagine some customers would even pay a bit more to not have to bother learning to generate a keypair and signing request themselves. The thing I don't understand is how the CEO thought things would likely work out…
It sounds like Trustico got these certificates from Symantec. The CEO of Trustico was arguing that they should be revoked as they weren't secure and emailed the private keys as proof. Which, while a dumb thing to do, did prove his point I guess. EDIT: From Trustico's account > We believe the orders placed via our Symantec account were at risk and were poorly managed. We have been questioning Symantec without response…
Seems like suddenly revoking 23k of their customer's certs with only 24 hours notice is just shooting themselves in the foot.
Earlier quoted context omitted.
If by "something you are comfortable with" you mean "reject web of trust". Trust is not transitive, which is the problem with web of trust. I trust a set of people. I do not necessarily trust the people those people trust.
If you reject the web of trust then you're saying you trust nobody (except yourself). Do you really not know anybody you trust to verify identities on your behalf? (That's a trick question because you trust the CAs).
Earlier quoted context omitted.
If by "something you are comfortable with" you mean "reject web of trust". Trust is not transitive, which is the problem with web of trust. I trust a set of people. I do not necessarily trust the people those people trust.
If you reject the web of trust then you're saying you trust nobody (except yourself). Do you really not know anybody you trust to verify identities on your behalf? (That's a trick question because you trust the CAs).
The author has a fundamental misunderstanding of the situation [1]. Trustico's awful decisions regarding
a) storing customers private keys and
b) improperly handling key material
Have no bearing whatsoever on EV certs, which verify the legal entities that run websites. This is like saying Trustico is bad, therefore HTTPS is bad.
[1] Assuming this is what the author said - the site is in plain HTTP so integrity isn't guaranteed.