Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The story of how WoSign gave me an SSL certificate for GitHub

schrauger.com

Post reply on HN
Print view View original

21–26 of 26 posts

Re: The story of how WoSign gave me an SSL certificate for GitHub

#21

Post by MichaelGG »

Hondor wrote: post #20
ryanmarsh wrote: post #5

Stuff like this is depressing. Are we ever going to have any semblance of privacy and security on the Internet? Everyone has been hacked, political figures, governments, businesses. In 100 years I think people are going to look back on this time and think we were all crazy like how we see safety in the early auto industry.

The early auto industry? They'll likely think we're crazy looking at our current auto industry. Who doesn't know anyone who was killed or seriously injured in a car crash?

How much of that is avoidable though? You still have people zooming around in big metal/composite boxes. There's only so much that can be done, especially given the culture around cars.

Re: The story of how WoSign gave me an SSL certificate for GitHub

#22

Post by thesimon »

anilgulecha wrote: post #15
anilgulecha wrote: post #14

This is nuts. The only long term solution here is a distributed decentralized DNS service. When there's "default-trust" at some locations (browser CAs), There's weak-points in the security chain. What are the best available dDNS solutions. Ideally these are initially backward compatible with redular DNS to help adoption, and then just disregard CAs.

Oh and browser vendors, distrust WoSign now! Imagine your regular developer performing a npm install which pulls in code from a compromised MITMed github URL. That's straightforward rootkit compile and install access!

>Oh and browser vendors, distrust WoSign now!

It's not like a lot happened to other authorities (a few pinky-promises)

Re: The story of how WoSign gave me an SSL certificate for GitHub

#24

Post by Manishearth »

hughw wrote: post #13
schrauger wrote: post #12

Earlier quoted context omitted.

WoSign is included as a root certificate. When they first started, they weren't in all browser stores, so StartCom cross-signed their root certificate. That way, WoSign could create certificates while they waited for browsers to update with their root certificate. It also helps for legacy/embedded systems that don't get updates, since StartCom has existed far longer. Due to the cross-sign, all WoSign certificates are…

OK thanks. Doesn't StartCom bear responsibility for the behavior of the entity they cross-signed for?

IIRC not in this case because WoSign had been accepted as a root, it just wasn't in all browsers yet. LetsEncrypt went through the same process -- it was accepted, but it takes time for root store updates to reach all consumers so in the meantime it was cross signed by some other ca. That ca has no responsibility here, since letsencrypt was itself accepted as a CA and was a peer (and is thus fully responsible for its own actions)

Re: The story of how WoSign gave me an SSL certificate for GitHub

#26

Post by VMG »

nmc wrote: post #25
VMG wrote: post #23

What's that best way to disable the WoSign cert on Arch Linux?

The GUI way: https://wiki.mozilla.org/CA:UserCertDB#Deleting_a_Root_Certi... The CLI way: http://unix.stackexchange.com/a/285831

Thanks! I hoped it wasn't a per-browser procedure, doesn't seem to work for chrome :/

Edit: chrome(ium) has a cert manager under "settings" that allows editing certificate trust levels

Post reply on HN