Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The story of how WoSign gave me an SSL certificate for GitHub

schrauger.com

Post reply on HN
Print view View original

11–20 of 26 posts

Re: The story of how WoSign gave me an SSL certificate for GitHub

#11

Post by jeff_marshall »

from the article:

>Domain validation is hard. It isn't as simple as one may think, and WoSign isn't the first to have a problem. They are still a trusted CA for now, and hopefully they will get their act together quickly.

The vulnerability exposed seems like a basic unit test to me (only assume ownership of validated domains or sub-domains - NOT all domains with a common root (or perhaps substring? the article is sparse on details)).

I had already lost faith in the 'everyone can be a root if they describe their process' model of trust before reading this post, but if software vendors that rely on trust anchors on their users behalf can't be bothered to do even basic due dilligence beyond vendor-sponsered audits, I'm left speachless.

Perhaps my experience with FIPS-140 has jaded me, but after seeing so much more money spent on paper-pushing than actual vulnerability assesment (and remediation), I can't help but feel lost after reading this.

Re: The story of how WoSign gave me an SSL certificate for GitHub

#12

Post by schrauger »

hughw wrote: post #9

The root cert for www.schrauger.com is StartCom Certificate Authority. Isn't it their (StartCom's) responsibility to make sure the owner of Certification Authority of WoSign (the next cert in the chain) is acting in accord with some terms and conditions? Secondly, should the browser vendors remove StartCom CA as a trusted root? Do they not do that because all the StsrtSSL sites would break? Fine with me, personally.…

WoSign is included as a root certificate. When they first started, they weren't in all browser stores, so StartCom cross-signed their root certificate.

That way, WoSign could create certificates while they waited for browsers to update with their root certificate. It also helps for legacy/embedded systems that don't get updates, since StartCom has existed far longer. Due to the cross-sign, all WoSign certificates are still compatible.

Re: The story of how WoSign gave me an SSL certificate for GitHub

#13

Post by hughw »

schrauger wrote: post #12
hughw wrote: post #9

The root cert for www.schrauger.com is StartCom Certificate Authority. Isn't it their (StartCom's) responsibility to make sure the owner of Certification Authority of WoSign (the next cert in the chain) is acting in accord with some terms and conditions? Secondly, should the browser vendors remove StartCom CA as a trusted root? Do they not do that because all the StsrtSSL sites would break? Fine with me, personally.…

WoSign is included as a root certificate. When they first started, they weren't in all browser stores, so StartCom cross-signed their root certificate. That way, WoSign could create certificates while they waited for browsers to update with their root certificate. It also helps for legacy/embedded systems that don't get updates, since StartCom has existed far longer. Due to the cross-sign, all WoSign certificates are…

OK thanks. Doesn't StartCom bear responsibility for the behavior of the entity they cross-signed for?

Re: The story of how WoSign gave me an SSL certificate for GitHub

#14

Post by anilgulecha »

This is nuts.

The only long term solution here is a distributed decentralized DNS service. When there's "default-trust" at some locations (browser CAs), There's weak-points in the security chain.

What are the best available dDNS solutions. Ideally these are initially backward compatible with redular DNS to help adoption, and then just disregard CAs.

Re: The story of how WoSign gave me an SSL certificate for GitHub

#15

Post by anilgulecha »

anilgulecha wrote: post #14

This is nuts. The only long term solution here is a distributed decentralized DNS service. When there's "default-trust" at some locations (browser CAs), There's weak-points in the security chain. What are the best available dDNS solutions. Ideally these are initially backward compatible with redular DNS to help adoption, and then just disregard CAs.

Oh and browser vendors, distrust WoSign now!

Imagine your regular developer performing a npm install which pulls in code from a compromised MITMed github URL. That's straightforward rootkit compile and install access!

Re: The story of how WoSign gave me an SSL certificate for GitHub

#16

Post by garaetjjte »

anilgulecha wrote: post #14

This is nuts. The only long term solution here is a distributed decentralized DNS service. When there's "default-trust" at some locations (browser CAs), There's weak-points in the security chain. What are the best available dDNS solutions. Ideally these are initially backward compatible with redular DNS to help adoption, and then just disregard CAs.

https://news.ycombinator.com/item?id=12382752

Re: The story of how WoSign gave me an SSL certificate for GitHub

#17

Post by sandstrom »

garaetjjte wrote: post #16
anilgulecha wrote: post #14

This is nuts. The only long term solution here is a distributed decentralized DNS service. When there's "default-trust" at some locations (browser CAs), There's weak-points in the security chain. What are the best available dDNS solutions. Ideally these are initially backward compatible with redular DNS to help adoption, and then just disregard CAs.

https://news.ycombinator.com/item?id=12382752

Some disagree that this is a good solution, e.g. https://news.ycombinator.com/item?id=12383795

Re: The story of how WoSign gave me an SSL certificate for GitHub

#18

Post by Redoubts »

hughw wrote: post #13
schrauger wrote: post #12

Earlier quoted context omitted.

WoSign is included as a root certificate. When they first started, they weren't in all browser stores, so StartCom cross-signed their root certificate. That way, WoSign could create certificates while they waited for browsers to update with their root certificate. It also helps for legacy/embedded systems that don't get updates, since StartCom has existed far longer. Due to the cross-sign, all WoSign certificates are…

OK thanks. Doesn't StartCom bear responsibility for the behavior of the entity they cross-signed for?

Supposedly they were bought by WoSign

http://letsphish.clonezone.link/part1

I say supposedly because this is an archive of the original domain

https://www.letsphish.org/

which now says

  > September 1, 2016:
  > I'm currently going under legal review of the site.
  > Content will not be available during this period.

Re: The story of how WoSign gave me an SSL certificate for GitHub

#19

Post by Natsu »

est wrote: post #7

So OP mentioned a question posted to stackexchange, clicked link, expected closed. https://security.stackexchange.com/questions/91292/ LOL good ol' stackexchange, closed as duplicate.

That "duplicate" has a rather vague answer that is almost completely unhelpful here.

Re: The story of how WoSign gave me an SSL certificate for GitHub

#20

Post by Hondor »

ryanmarsh wrote: post #5

Stuff like this is depressing. Are we ever going to have any semblance of privacy and security on the Internet? Everyone has been hacked, political figures, governments, businesses. In 100 years I think people are going to look back on this time and think we were all crazy like how we see safety in the early auto industry.

The early auto industry? They'll likely think we're crazy looking at our current auto industry. Who doesn't know anyone who was killed or seriously injured in a car crash?
Post reply on HN