Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: TinyCert – Certificates as a service

tinycert.org

Post reply on HN
Print view View original

11–20 of 24 posts

Re: Show HN: TinyCert – Certificates as a service

#13

Post by kolev »

rolfvandekrol wrote: post #11
kolev wrote: post #6

I just wonder why there's zero info about who's behind this.

This guy: Steven Don (@shdon): https://twitter.com/shdon Same nickname as the OP and tweets about tinycerts.

Thanks! It's a great project and better transparency will definitely help its adoption.

Re: Show HN: TinyCert – Certificates as a service

#15

Post by shdon »

iancarroll wrote: post #9
mappu wrote: post #7

> The generated keypairs are 1024-bit RSA public and private keys ... This is sufficiently strong for use on the web in the present day 1024-bit RSA certificates are considered deprecated, no longer issued, and if they don't already throw browser warnings then they will soon.

Indeed, this should be changed. The root is 2048 bits, but it's still unacceptable to issue 1024-bit certificates.

I will indeed update this. It is still a work in progress.

Re: Show HN: TinyCert – Certificates as a service

#16

Post by shdon »

hsivonen wrote: post #14

Not cool. Private keys generated on their servers and then the idea of inatalling the certs as trusted in your OS/browser is mentioned. Also 1024-bit keys. Is this some kind of test to see who falls for this?

This is not intended to be a substitute for a proper CA, not intended to be used in production. Only for convenience and if you trust yourself and the service, you can install the your root certificate in your browser. If not, then don't. Just like pushing past the security warning, I strongly recommend against the procedure to end users. Only to people who know what they are doing.

Re: Show HN: TinyCert – Certificates as a service

#17

Post by shdon »

geoffhotchkiss wrote: post #8

It's nice that this service is trying to make it easier, but why should anyone trust tinycert? How can I trust that tinycert won't issue certificates without my concert? Or sell my private keys to others? The commands really aren't that complicated. You can (and really should) learn how to do this if you need to issue certificates. Also, deleting CA's doesn't seem to work.

Thanks for the bug report. I'll look into that.

As for why to trust it... you won't know to trust me any more than a real CA. With a real CA you also only have their word. I've taken as many steps as I can to ensure that the private keys are not kept unencrypted anywhere where this is not needed (and they are only needed when signing something and when you request a download) and that the passphrase is in flight as short as possible.

While anything is theoretically possible with enough malicious intent, I've made the selling private keys or issuing certificates with your private key without your consent as exceedingly difficult as possible for myself.

Re: Show HN: TinyCert – Certificates as a service

#18

Post by shdon »

akerl_ wrote: post #3

"Is it safe? ... Unless you install your own CA certificate in the browser or in the root certificate store of whatever other technology you use, they will complain about not being able to validate the certificates. This does not mean they are unsafe, just that they don't know to trust the certificates." Not being able to trust that you're talking to who you think to are seems like a serious example of "not safe". Te…

Untrusted, fraudulent and unsafe are three entirely different things. Just because the browser doesn't trust the certificate does not mean it is unsafe or fraudulent. You as the end user can verify whether the certificate the browser presents is the one you installed yourself and as such whether you're talking to who you think you're talking to.

I can't control what people do with the certificates, but I'm recommending against the use of TinyCert certificates for the public web. When used as intended, only people who have themselves generated and installed the TinyCert certificates (or their associates if so instructed) will see them and click past. Anybody else should get the big scary warning and will hopefully, rightfully, heed it.

Re: Show HN: TinyCert – Certificates as a service

#19

Post by shdon »

shdon wrote: post #17
geoffhotchkiss wrote: post #8

It's nice that this service is trying to make it easier, but why should anyone trust tinycert? How can I trust that tinycert won't issue certificates without my concert? Or sell my private keys to others? The commands really aren't that complicated. You can (and really should) learn how to do this if you need to issue certificates. Also, deleting CA's doesn't seem to work.

Thanks for the bug report. I'll look into that. As for why to trust it... you won't know to trust me any more than a real CA. With a real CA you also only have their word. I've taken as many steps as I can to ensure that the private keys are not kept unencrypted anywhere where this is not needed (and they are only needed when signing something and when you request a download) and that the passphrase is in flight as s…

Deletion is fixed.

Re: Show HN: TinyCert – Certificates as a service

#20

Post by shdon »

tatterdemalion wrote: post #12

This obviously should not be added to the list of trusted CAs in any browser, and these certs should not be used in the public web. Unfortunately, neither should many certificate authorities be trusted. https://www.youtube.com/watch?v=pDmj_xe7EIQ

Just to clarify: there is not 1 root certificate for all of the TinyCert generated certificates. There are root certificates for every single account. I did this intentionally to ensure that nobody would be careless enough to trust such a root and thus implicitly trust every TinyCert certificate everywhere. Basically, only the people who created their own CA through TinyCert have any business installing their root certificates (and only theirs!) into their browsers.
Post reply on HN