Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Chinese CA WoSign faces revocation after possibly issuing fake certificates

percya.com

Post reply on HN
Print view View original

111–116 of 116 posts

Re: Chinese CA WoSign faces revocation after possibly issuing fake certificates

#111

Post by mindslight »

X-Cubed wrote: post #109
mindslight wrote: post #104

Earlier quoted context omitted.

Trust of a CA doesn't have to be binary - it could be stochastic. Let's say that when a browser wishes to revoke a CA certificate, it chooses a timeframe for a "deprecation period". Before the deprecation period, the CA is fully trusted. After the deprecation period, it has been completely eliminated. During the deprecation period, a browser will possibly pop up an error page rather than accepting the certificate. Th…

Would that not just encourage your average user to click through the security warnings and ignore them, potentially numbing them to other more important warnings? Users aren't the ones who should feel the pain of a rogue CA, we need the CA to feel the pain somehow.

Perhaps it'd be better as a series of progressive informational pages than described in terms of certificate rejection. The central idea is that the site will become gradually less usable.

If a CA is being revoked, that's pretty close to the maximum pain they'll feel. But suddenly revoking a CA will cause users the most pain - I'm trying to make that gradual. A competent site would react in the first week when a few users got a mild warning, get a certificate from a new CA, then hopefully complain to the original CA demanding a refund and whatnot.

Re: Chinese CA WoSign faces revocation after possibly issuing fake certificates

#112

Post by pfg »

Kadin wrote: post #110
LoSboccacc wrote: post #22

Earlier quoted context omitted.

but you have to code that in every browser and hope people will be able to patch up. a revocation list from parent certificate company nuking the ca is the intended way to deal with trust breach, it should be supported everywhere, and doesn't require a full redeployment of browsers (And sometime entire OSes!) across the world.

Most major (non-embedded, I suppose) OSes have some framework for periodically updating the certificate store. It's not necessarily a full redeployment of the OS. Mac OS and Windows both are capable of receiving new root certs via the OS update process. Apple says it updates certs approximately once per quarter: https://www.apple.com/certificateauthority/ca_program.html I think there is a pretty strong argument for t…

While Chrome technically does not have the kind of root program that other OS or browser vendors run, they have the ability to revoke trust for specific roots, plus other things, like enforcing CT for specific CAs. Given that there's already a root program that's being run transparently, there's not that big of an incentive to run yet another root program, IMO. Plus, while I'm extremely happy that Mozilla is running their own root program for various reasons, using existing OS APIs for these things seems like the cleanest approach (if you can't trust your OS to make these decisions, you probably have bigger problems and shouldn't run that OS anyway).

Re: Chinese CA WoSign faces revocation after possibly issuing fake certificates

#113

Post by MertsA »

icebraining wrote: post #84
794CD01 wrote: post #76

Earlier quoted context omitted.

If you don't "trust Chinese companies not to MITM your site" then why do you trust CNNIC enough that you decided to register your domain in .cn?

Because by pinning the cert, I can reasonably make sure they can't abuse that power.

But why not do both? It's unreasonable that there is a mountain of CAs out there that never sign certs for .us but they still have the capability to do so. The more CAs that can sign a cert for my domain, the more chances that someone screws up. At the very least I agree with limiting CAs to a subset of TLDs for protection from hypothetical things like the Turkish government demanding that a Turkish CA signs a cert for facebook.com. If it was a countrywide attack pinning the valid cert wouldn't be very effective if the browser has never been to your site before.

Re: Chinese CA WoSign faces revocation after possibly issuing fake certificates

#114

Post by icebraining »

MertsA wrote: post #113
icebraining wrote: post #84

Earlier quoted context omitted.

Because by pinning the cert, I can reasonably make sure they can't abuse that power.

But why not do both? It's unreasonable that there is a mountain of CAs out there that never sign certs for .us but they still have the capability to do so. The more CAs that can sign a cert for my domain, the more chances that someone screws up. At the very least I agree with limiting CAs to a subset of TLDs for protection from hypothetical things like the Turkish government demanding that a Turkish CA signs a cert f…

But why not do both?

Because then you're stuck using that country's CAs, and so you can't pin the root or intermediate certs without giving them the keys. You could pin your cert, but that has other disadvantages.

Re: Chinese CA WoSign faces revocation after possibly issuing fake certificates

#115

Post by [deleted] »

Kadin wrote: post #108
joosters wrote: post #53

Earlier quoted context omitted.

Site operators need to be more aware of which CAs they're using How? I've got no way to judge the security / responsibility of any CA. The amount of money that they charge may have no relation to their behaviour. I don't think anyone has claimed that the CAs who issued wrong certs were charging less than their competitors. You can't blame the CA customers for this.

That's a chicken-and-egg problem, but it would be solved when there's suddenly a lot of site operators with a vested interest in knowing which CAs are likely to fail and which aren't. Right now there's not a ton of interest. CAs are basically selling a fungible, commodity product, so you just buy from the cheapest ones. Searching for "best SSL certificates" thus gets you a lot of articles reviewing CAs, but largely o…

[deleted]

Re: Chinese CA WoSign faces revocation after possibly issuing fake certificates

#116

Post by nguoiduatin196 »

http://phukhoathaiha.com/thuoc-chua-benh-sui-mao-ga-o-nam-gi...

Nam giới là đối tượng rất dễ mắc các bệnh lây nhiễm, đặc biệt là các bệnh lây truyền qua đường tình dục như các bệnh xã hội do lối sống của nam giới trong chuyện này thoáng hơn rất nhiều. Sùi mào gà là một trong những bệnh xã hội phổ biến và có nguy cơ lây nhiễm bệnh cao nhất. Mặc dù sùi mào gà ở nam giới có biến chứng và ủ bệnh và lâu hơn ở nữ giới nhưng gây ra rất nhiều những phiền toái và rắc rối cho người bệnh. Vậy khi bị mắc sùi mào gà ở nam giới, sử dụng thuốc điều trị nào là hiệu quả nhất.

Post reply on HN