[deleted]
How not to run a CA
111–120 of 255 posts
Re: How not to run a CA
#112Earlier quoted context omitted.
Up until a few years ago there was a tag which embedded a x509 CSR generator into a regular HTML form. The private key was generated by the browser(1) and was completely inaccessible to the site or any JS running on it. That's the proper way to generate certificates in browsers, but it's been removed since and was never supported in IE. StartSSL used it, for example, but also allowed you to hand them a CSR of your ow…
It can't be that hard to whip up a cross platform Qt app that streamlines the keygen and CSR process in a user friendly fashion. Maybe throw in some dodgy key escrow service for the daring. Why does everything have to be done over the web.
It already exists, e.g. https://www.digicert.com/util/
The problem is, people who don't understand the issue will prefer a solution that doesn't require installing some software.
Re: How not to run a CA
#113Earlier quoted context omitted.
Which they cannot enforce on the web except by blocking (aka censoring the web).
They could fine you.
I live in the US, operate in the US, and if I ever go to the EU, I am quite confident that the system won't move quickly enough to notice I'm in the EU and collect fines during a tourist stay. So no, they couldn't fine me. If they did fine me, there would be zero repercussions for simply ignoring the fine.
I am not saying I plan to break this law: I'm a big supporter of encrypting everything and I was in compliance with this law before this law existed. I think that this law is a big positive step for privacy in the EU.
I am saying that the claims that this EU law will have massive international effects are overblown. There are five other continents with major businesses and only the businesses which operate in the EU have any reason to care about EU laws which are enforceable only in the EU.
EDIT: I accidentally a continent.
Re: How not to run a CA
#114> TL;DR: Forget your EV or other certs. Just run “Let’s Encrypt”. The author has a fundamental misunderstanding of the situation [1]. Trustico's awful decisions regarding a) storing customers private keys and b) improperly handling key material Have no bearing whatsoever on EV certs, which verify the legal entities that run websites. This is like saying Trustico is bad, therefore HTTPS is bad. [1] Assuming this is wh…
There is at least some merit to the argument that "Trustico Bad" => "CAs bad" => "HTTPS Bad". More than one CA has been shown to be extremely lacking in trustworthiness and that trust is important. I'm OK with the centralised model but there needs to be a bit more visibility of the CA process.
I'd settle for an end to the credentialism that ensures only the rich and powerful can enter the CA business. The actual technical chops and physical/operational requirements to become a CA are modest by the standards of the average HN reader, but the financial cost for the audit required to wind up in the browser trust stores is prohibitively high.
...That, and given the massive failures we've seen coming out of the CA world recently, I question whether those audits are actually worth anything.
Re: How not to run a CA
#115Earlier quoted context omitted.
You presumably got downvoted for being pedantic here, but I think your pedantry is reasonable. If someone's going say "X is fundamentally broken", they should know what X is actually called. Referring to TLS as SSL reeks of amateur hour and shallow knowledge[1], and is a mistake on par with referring to Javascript as Java. [1] This is the sort of lazy mistake I would make, because I'm not a security expert.
Yes, technically it's TLS, not SSL. TLS, however, is an "evolution" of SSL and many, many people still use this nomenclature. It doesn't "reek of amateur hour and shallow knowledge", it's just a holdover from the past. We all know and understand what others are referring to when they say "SSL". It's like when I tell the girlfriend I'm going to go on a "bike ride". She understands that I mean I'm going for a ride on m…
> It's like when I tell the girlfriend I'm going to go on a "bike ride". She understands that I mean I'm going for a ride on my Harley, a motorcycle, and not an actual bicycle.
Try saying this in the Netherlands (or, presumably, Denmark). Everyone would be surprised when you bring out your motorcycle instead of your bike (i.e., bicycle).
Re: How not to run a CA
#116Earlier quoted context omitted.
Why would they not try to transition their customers to new certs _before_ getting all the old certs revoked though? Seems like suddenly revoking 23k of their customer's certs with only 24 hours notice is just shooting themselves in the foot.
We're using the Symantec/Digicert API for getting certs at work. I'm not directly involved in that, but I think when you want to issue a new cert you have to revoke the old one first. The API will just return an error if there is an existing cert for the same domain name. I recall vividly that when we moved from manually-issued certs (using their website) to automatic issuing (using their API), we had to revoke all c…
That makes no sense; how would you extend a cert at the end of its life? If you have to revoke one to get a new one, that means you will have to take an outage, since you will need to get the new cert and install it after revoking the old one.
Re: How not to run a CA
#117"Bad Actors" in the tech field tend to flock together. Comodo has been at the center of several really ugly stories, this one being the latest. The CEO of Comodo attempted to sue Lets Encrypt before they launched, in order to kill the project because of the threat it represented to their business model. after 24 hours of backlash from the internet public he backed down and said it was all a misunderstanding. Of cours…
Your argument for guilt by association is not compelling. Cloudflare is their customer. I am Cloudflare’s customer. Does that make me a bad actor too?
[deleted]
Re: How not to run a CA
#118Re: How not to run a CA
#119"Bad Actors" in the tech field tend to flock together. Comodo has been at the center of several really ugly stories, this one being the latest. The CEO of Comodo attempted to sue Lets Encrypt before they launched, in order to kill the project because of the threat it represented to their business model. after 24 hours of backlash from the internet public he backed down and said it was all a misunderstanding. Of cours…
Your argument for guilt by association is not compelling. Cloudflare is their customer. I am Cloudflare’s customer. Does that make me a bad actor too?
The question is: why does cloadflrare even use them?
There are like ten thousand other options...
Re: How not to run a CA
#120letsencrypt is great and I use it. But I don't really get it. All I needed to do was prove that I could place a generated file on the server that I wanted the certificate for. This seems to me to be a very low bar. What am I missing?
The bar for basic certs has been, for some time, an indication of control over the DNS domain in question. In the past, the bar used to be much higher. Whether a lower bar is a good idea or not I will leave to other more informed folk.
When was it higher, and what made it higher? The only extra thing that you used to have to do is pay money....