Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

StartSSL, please revoke me – My private key has been compromised

revokame.tonylampada.com.br

Post reply on HN
Print view View original

11–20 of 71 posts

Re: StartSSL, please revoke me – My private key has been compromised

#11

Post by higherpurpose »

lstamour wrote: post #7

I've used these guys in the past and quite like them, but yeah, this is poor PR and I hope they get pulled for not paying attention to, you know, the overall security of the trust product they're selling. I don't want lock-in on my SSL cert but it's effectively a contract if I have to pay a fee to break it and the SSL padlock on my domain is held hostage if I don't. Maybe someone should open a bug report on Bugzilla.…

There are arguments about this being "their right" to not give free cert revocation, since that's how their business model works. They give you free certificates, but then you must pay quite a bit to revoke them.

That being said, PR wise, this was a pretty dumb move by them. It should've been a great PR opportunity for them, by submitting a blog post on HN about how serious this issue is and how they're going to allow everyone to revoke their certificate, say for the next 7 days, or even 48h. Everyone would've had their hands in the air cheering for StartSSL, about what an awesome company it is for doing this, and they would've gained a lot of good will and trust from the community for many years to come.

Instead, they saw this as an opportunity to make as much as money as possible in the short term, regardless of how catastrophic this vulnerability was. In a way, it's like stores raising the price of food and water in a time of crisis (natural disaster, war, etc) because they know they can get away with it then, since so many people need it, and they're the only source in the area.

Bottomline is, they could've made a judgement call to "not make" some extra cash in this period, while gaining a lot of long-term trust from its current and potential customers, but instead they decided to take the money, and have a PR scandal on their hands. Not a great move at all.

Re: StartSSL, please revoke me – My private key has been compromised

#12

Post by techsupporter »

Classic Big Lebowski moment: You're not wrong, you're just an asshole. Their stance is entirely correct. The customer used a file that StartCom provided in software that turns out to have had a security flaw. That's neither StartCom's problem nor liability. They didn't say "use this certificate with anything other than OpenSSL; you'll be sorry if you use OpenSSL," nor could they have foreseen it.

On the other hand, showing a cold unwillingness to help when doing so is by far the above-and-beyond response doesn't engender good customer loyalty. It's also how StartCom operates. This is the same cert authority that insisted that I send them a full, unredacted copy of a mobile telephone bill with every "family plan" member's full call, SMS, and data history in order to call me. Otherwise, they could only "verify" me by sending a snail mail letter from Israel to South America (where I lived at the time). Independently-linked, outside verification databases operated by local government entities weren't sufficient.

At least they're consistent with their "rules are rules" processes.

Re: StartSSL, please revoke me – My private key has been compromised

#13

Post by lstamour »

saurik wrote: post #9
lstamour wrote: post #7

I've used these guys in the past and quite like them, but yeah, this is poor PR and I hope they get pulled for not paying attention to, you know, the overall security of the trust product they're selling. I don't want lock-in on my SSL cert but it's effectively a contract if I have to pay a fee to break it and the SSL padlock on my domain is held hostage if I don't. Maybe someone should open a bug report on Bugzilla.…

So, to verify, would you rather pay a (smaller) fee upfront for every registration (effectively, insurance against revocation), rather than pay a (larger) fee if and only if you ever need to revoke? (Or, are you saying that StartSSL is somehow evil, because they refuse to do everything you ever wished they could do for you with no compensation of any kind?) (Is the issue simply that they won't revoke without a fee, e…

Hmm. Would I rather pay a fee every year for my domain name or only if I happen to need to change my name servers, contact info or account password. Perhaps more realistically, pay the host before a transfer or early termination. Yes, getting started might be free, but that just makes accidental lock in easier. Life happens, changes happen. Free should be free, is all I'm saying. Makes for a better internet. Maybe browser vendors should offer free SSL certs, or promote pinning self-signed ones somehow? ;-)

Re: StartSSL, please revoke me – My private key has been compromised

#14

Post by taspeotis »

techsupporter wrote: post #12

Classic Big Lebowski moment: You're not wrong, you're just an asshole. Their stance is entirely correct. The customer used a file that StartCom provided in software that turns out to have had a security flaw. That's neither StartCom's problem nor liability. They didn't say "use this certificate with anything other than OpenSSL; you'll be sorry if you use OpenSSL," nor could they have foreseen it. On the other hand, s…

    Their stance is entirely correct
Well it sounds like their stance is wrong if they've agreed to the Mozilla CA Certificate Maintenance Policy:

    CAs must revoke Certificates that they have issued
    upon the occurrence of any of the following events:
    
    ...
    
      the CA obtains reasonable evidence that the
      subscriber’s private key (corresponding to the
      public key in the certificate) has been compromised

Re: StartSSL, please revoke me – My private key has been compromised

#15

Post by Nanzikambe »

To better understand the stupidity in leaving the power with the CI for SSL/TLS :

  $ gpg --gen-revoke $(whoami)@$(hostname -f)
   
  gpg (GnuPG) 2.0.22; Copyright (C) 2013 Free Software Foundation, Inc.
  This is free software: you are free to change and redistribute it.
  There is NO WARRANTY, to the extent permitted by law.

  How would you like to pay us?
  
      (1) Mastercard
      (2) VISA
      (3) Other

   Your selection?
Also, a dark cynical part of me wants to ask exactly what the business model behind "free" SSL certs is? You're not paying them, someone else is?

Re: StartSSL, please revoke me – My private key has been compromised

#16

Post by berkes »

achille wrote: post #6
tonylampada wrote: post #5

So now it's official. They got the evidence that the certificate is compromised yet they refuse to take action. If that's not violation of CA policy I don't know what is.

How dare they give you a free service, and then decide to charge for a revocation which they had said they would charge for (and is meaningless because by default all browsers ignore revocations). Unfortunately for various historical fuckups, we consider self signed certificates to be more dangerous than cleartext unsecured http. Lots of scary warnings pop up. That is absurd. Starcom is helping fix this by issuing fr…

> (and is meaningless because by default all browsers ignore revocations)

Strange, because when I revoked my cert at StartSSL yesterday (and payed for it), the browser, Firefox on Ununtu immediately showed it as revoked. With a big bold warning when visiting the page.

Re: StartSSL, please revoke me – My private key has been compromised

#17

Post by pkteison »

techsupporter wrote: post #12

Classic Big Lebowski moment: You're not wrong, you're just an asshole. Their stance is entirely correct. The customer used a file that StartCom provided in software that turns out to have had a security flaw. That's neither StartCom's problem nor liability. They didn't say "use this certificate with anything other than OpenSSL; you'll be sorry if you use OpenSSL," nor could they have foreseen it. On the other hand, s…

They should collect enough up front to make the revocation pre-paid. Refusing to revoke certs results in an unsafe internet and ruins the value of the entire service they are supposed to be providing.

Re: StartSSL, please revoke me – My private key has been compromised

#18

Post by Nanzikambe »

egeozcan wrote: post #8
achille wrote: post #6

Earlier quoted context omitted.

How dare they give you a free service, and then decide to charge for a revocation which they had said they would charge for (and is meaningless because by default all browsers ignore revocations). Unfortunately for various historical fuckups, we consider self signed certificates to be more dangerous than cleartext unsecured http. Lots of scary warnings pop up. That is absurd. Starcom is helping fix this by issuing fr…

I'm also against bashing of StartSSL but they could at least show some good will. "I'm not angry, I'm just disappointed"

Nothing wrong with bashing a free product or service.

If I paint two pieces of art, one I let you view for free, the other I charge to view - are you only entitled to an opinion on the latter?

Re: StartSSL, please revoke me – My private key has been compromised

#19

Post by jrockway »

Personally, I'd just send a patch to my favorite browser removing their certificate from the trust chain, and then send StartSSL an email with a link to that. Although I doubt anyone will merge your change, it sends a cynical message about how their entire business lives and dies at the whims of people with commit access to the list of trusted CAs.

Re: StartSSL, please revoke me – My private key has been compromised

#20

Post by hnha »

pkteison wrote: post #17
techsupporter wrote: post #12

Classic Big Lebowski moment: You're not wrong, you're just an asshole. Their stance is entirely correct. The customer used a file that StartCom provided in software that turns out to have had a security flaw. That's neither StartCom's problem nor liability. They didn't say "use this certificate with anything other than OpenSSL; you'll be sorry if you use OpenSSL," nor could they have foreseen it. On the other hand, s…

They should collect enough up front to make the revocation pre-paid. Refusing to revoke certs results in an unsafe internet and ruins the value of the entire service they are supposed to be providing.

They don't refuse, they charge money for this specific service. Protecting your keys is your obligation, not theirs.
Post reply on HN