11–20 of 75 posts
OK, so this seems like a terrible vulnerability. Does anyone know if (a) StartSSL has been notified and (b) what has been their response. This seems like such a severe vulnerability that publishing it on Blogspot seems too low key. Shouldn't there be a CVE about this?
Now that Let's Encrypt is a thing, there's no reason to do business with these greedy losers. That's not just an off the cuff insult either - I find very few charitable words to describe a company that charges $25 to rekey a certificate for reasons outside the user's control, i.e. heartbleed. More to the point, in my arrogant opinion, now that a good , free alternative exists, users in the know should pressure the br…
Let's Encrypt avoided this by partnering with Akamai. Though StartCom really should have made an exception for Heartbleed.
Back before I found Gandi.net I came across StartSSL (I was looking for basic SSL certifications.) At the time StartSSL's website was horrible, and I mean ugly, it turned me away because it felt so unprofessional. I see now, even with a new flashy website, that they still remain unprofessional (maybe not in their looks, but obviously in their practices.)
When prompting for "postmaster", "hostmaster" or "webmaster", the values in that form should be just those and StartSSL should then put the two together ($MASTER_EMAIL + "@" + $DOMAIN.) They shouldn't assume that the "sendToEmail" value wasn't tampered with or overridden. If the original poster didn't include his screenshots or his steps then I wouldn't believe such a stupid mistake, especially one made by a certific…
It's amazing that their web component is even allowed to dictate what verification addresses are permittable. That should be the concern of a completely separate component of their infrastructure. Says a lot of about their security architecture, I guess.
When prompting for "postmaster", "hostmaster" or "webmaster", the values in that form should be just those and StartSSL should then put the two together ($MASTER_EMAIL + "@" + $DOMAIN.) They shouldn't assume that the "sendToEmail" value wasn't tampered with or overridden. If the original poster didn't include his screenshots or his steps then I wouldn't believe such a stupid mistake, especially one made by a certific…
Your solution is still vulnerable in cases where someone's able to control postmasterfoobar@example.com. Admittedly, that's a bit far-fetched, but the correct solution would be to have an enumeration of allowed emails and only accept those (or, more generally: whitelist things). It's amazing that their web component is even allowed to dictate what verification addresses are permittable. That should be the concern of…
Meanwhile, when I tried to use them for a client's domain after actually paying $$$ for business validation I was refused because the names on the WHOIS records didn't match our business name.
So, I corrected my WHOIS records... After which they complained that the legal disclaimer posted on the website served from the domain in question was not identical to the registered identity that they had on file for me.
So, I updated that legal disclaimer (since I have root on my own server), and afterward, they STILL refused to validate the domain on grounds that it may only be validated as a business -- a service which they tried to sell me.
15 minutes later, I was up and running with my first Let's Encrypt-issued cert.
Awful customer service at StartSSL.
A vulnerability of this level is inexcusable. StartSSL ought to be removed from all major browsers.
Mozilla, Google, Apple and Microsoft should remove this CA ASAP. If it breaks some sites, even better. Maybe it will make some noise and fix all this CA bullshit for good.