Remediation Plan for WoSign and StartCom • Hacker News Board

Re: Remediation Plan for WoSign and StartCom

#11

Post by 0x0 » Thu, Oct 13, 2016, 6:10 PM UTC

jasonjei wrote: post #8

Just curious about the root certificate distrust--are users capable of re-adding trust to distrusted certificates? Or is this hard coded into the browser? I'm assuming Mozilla stores certificates outside OS stores like Keychain and Windows?

Yes but why would you? If you have control of all your clients to push such a change, why not just set up a private CA instead of opening yourself up to the whims of a proven cheating CA?

Re: Remediation Plan for WoSign and StartCom

#12

Post by 0x0 » Thu, Oct 13, 2016, 6:12 PM UTC

codyro wrote: post #6

0x0 wrote: post #2

So they are actually kicking out StartCom as well. Is this new? Apple was quick to move to kick out WoSign but they seemed to keep StartCom around. https://support.apple.com/en-us/HT204132

I believe so - they're owned by the same company and it wasn't disclosed properly leading to some trust issues. Additionally there seems to be a lot of co-mingling between the companies in regards to code bases and signing practices. I'd check out https://wiki.mozilla.org/CA:WoSign_Issues and look for "StartCom" for examples.

I remember the secret StartCom change of ownership came up very early in these discussions (I even saw random forum posts, on HN and elsewhere, almost a year earlier, when people noticed the StartCom servers mysteriously switched to Chinese IP addresses, and switched all my certs away as a precaution before there was any talk about CA mismanagement). But until now I've only seen talk of actually kicking out WoSign. Good riddance either way. Wonder what happened to the StartCom people, they seemed to be clued in back in the days. Shame.

Re: Remediation Plan for WoSign and StartCom

#13

Post by pfg » Thu, Oct 13, 2016, 6:13 PM UTC

asayler wrote: post #10

jasonjei wrote: post #8

Just curious about the root certificate distrust--are users capable of re-adding trust to distrusted certificates? Or is this hard coded into the browser? I'm assuming Mozilla stores certificates outside OS stores like Keychain and Windows?

In general, locally added roots are trusted above all else -- and will even override cert pinning on most systems. Thus, if a user were to manually re-add the Wosign or Startcom roots to the local Mozilla trust store, they would continue to be trusted.

Sounds about right, but one thing to keep in mind is that "Removal of root" is only one possible route Mozilla can go for. They could also revoke (root or intermediate) certificate(s) through OneCRL, and while I haven't tried this, my guess would be that OneCRL trumps locally-added roots.

That being said, the current plan is not to remove any of the roots (at least until all active certificates chaining up to those roots have expired), but rather not to trust certificates chaining to those roots with a notBefore date > October 21, 2016.

Re: Remediation Plan for WoSign and StartCom

#14

Post by scrollaway » Thu, Oct 13, 2016, 6:20 PM UTC

What did I miss? Last I heard about this, the plan was to ban them from issuing new certificates for a year. Did something change?

Re: Remediation Plan for WoSign and StartCom

#15

Post by InclinedPlane » Thu, Oct 13, 2016, 6:23 PM UTC

scrollaway wrote: post #14

What did I miss? Last I heard about this, the plan was to ban them from issuing new certificates for a year. Did something change?

They admitted they screwed up and the CEO stepped down.

Re: Remediation Plan for WoSign and StartCom

#16

Post by pfg » Thu, Oct 13, 2016, 6:24 PM UTC

0x0 wrote: post #12

codyro wrote: post #6

Earlier quoted context omitted.

I believe so - they're owned by the same company and it wasn't disclosed properly leading to some trust issues. Additionally there seems to be a lot of co-mingling between the companies in regards to code bases and signing practices. I'd check out https://wiki.mozilla.org/CA:WoSign_Issues and look for "StartCom" for examples.

I remember the secret StartCom change of ownership came up very early in these discussions (I even saw random forum posts, on HN and elsewhere, almost a year earlier, when people noticed the StartCom servers mysteriously switched to Chinese IP addresses, and switched all my certs away as a precaution before there was any talk about CA mismanagement). But until now I've only seen talk of actually kicking out WoSign. G…

The original plan[1] was to distrust both WoSign and StartCom after a certain date. Shortly after that, Mozilla met with representatives from Qihoo, WoSign and StartCom, and considered the possibility of treating StartCom separately under certain conditions[2]. The latest remediation plan seems to discard that notion (except that only WoSign will have to wait a year to re-apply).

[1]: https://docs.google.com/document/d/1C6BlmbeQfn4a9zydVi2UvjBG...

[2]: https://groups.google.com/forum/#!topic/mozilla.dev.security...

Re: Remediation Plan for WoSign and StartCom

#17

Post by dredmorbius » Thu, Oct 13, 2016, 6:32 PM UTC

neom wrote: post #5

It's really great to see E&Y HK being held to account on this also. :thumbs_up:

My jaw hit the floor on that item.

Trust matters.

Re: Remediation Plan for WoSign and StartCom

#18

Post by kchoudhu » Thu, Oct 13, 2016, 6:39 PM UTC

neom wrote: post #5

It's really great to see E&Y HK being held to account on this also. :thumbs_up:

Why just HK, though?

Re: Remediation Plan for WoSign and StartCom

#19

Post by tptacek » Thu, Oct 13, 2016, 6:39 PM UTC

scrollaway wrote: post #14

What did I miss? Last I heard about this, the plan was to ban them from issuing new certificates for a year. Did something change?

That remains the plan.

Re: Remediation Plan for WoSign and StartCom

#20

Post by jpablo » Thu, Oct 13, 2016, 6:44 PM UTC

I dont like this route. The only value for the WoSign keys for a whole year would be issuing certificates with a doctored notBefore date, and they can't do that publically.