Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

StartSSL, please revoke me – My private key has been compromised

revokame.tonylampada.com.br

Post reply on HN
Print view View original

21–30 of 71 posts

Re: StartSSL, please revoke me – My private key has been compromised

#21

Post by jamescun »

Nanzikambe wrote: post #15

To better understand the stupidity in leaving the power with the CI for SSL/TLS : $ gpg --gen-revoke $(whoami)@$(hostname -f) gpg (GnuPG) 2.0.22; Copyright (C) 2013 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. How would you like to pay us? (1) Mastercard (2) VISA (3) Other Your selection? Also, a dark cynical pa…

Only their entry level certificate is free, they have higher priced options for the likes of wildcard and EV certificates. Once your root certificate has a good level of acceptance, the true cost of certificates is the validation process; actual certificate generation is negligible, hence certificates with little-to-no validation can be offered at little-to-no charge.

Re: StartSSL, please revoke me – My private key has been compromised

#22

Post by mixedbit »

achille wrote: post #6
tonylampada wrote: post #5

So now it's official. They got the evidence that the certificate is compromised yet they refuse to take action. If that's not violation of CA policy I don't know what is.

How dare they give you a free service, and then decide to charge for a revocation which they had said they would charge for (and is meaningless because by default all browsers ignore revocations). Unfortunately for various historical fuckups, we consider self signed certificates to be more dangerous than cleartext unsecured http. Lots of scary warnings pop up. That is absurd. Starcom is helping fix this by issuing fr…

> The Mozilla CA policy does not include a provision for obvious trolling and posturing.

This isn't really trolling, after Heartbleed we should consider all SSL certs used by OpenSSL based servers as compromised. This sites just tries to make the point more obvious by putting such compromised cert in public view.

Re: StartSSL, please revoke me – My private key has been compromised

#23

Post by A_COMPUTER »

tonylampada wrote: post #5

So now it's official. They got the evidence that the certificate is compromised yet they refuse to take action. If that's not violation of CA policy I don't know what is.

I think you're right, if there's evidence the key is compromised, they should revoke first. Then they should bill you, and if you choose not to pay, they should send it to a collections agency.

Re: StartSSL, please revoke me – My private key has been compromised

#24

Post by Nanzikambe »

jamescun wrote: post #21
Nanzikambe wrote: post #15

To better understand the stupidity in leaving the power with the CI for SSL/TLS : $ gpg --gen-revoke $(whoami)@$(hostname -f) gpg (GnuPG) 2.0.22; Copyright (C) 2013 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. How would you like to pay us? (1) Mastercard (2) VISA (3) Other Your selection? Also, a dark cynical pa…

Only their entry level certificate is free, they have higher priced options for the likes of wildcard and EV certificates. Once your root certificate has a good level of acceptance, the true cost of certificates is the validation process; actual certificate generation is negligible, hence certificates with little-to-no validation can be offered at little-to-no charge.

Fair play, now I know. The hand waving wild-eyed long-haired conspiracy theorist in me has been silenced .. for now :)

Re: StartSSL, please revoke me – My private key has been compromised

#25

Post by __david__ »

Nanzikambe wrote: post #15

To better understand the stupidity in leaving the power with the CI for SSL/TLS : $ gpg --gen-revoke $(whoami)@$(hostname -f) gpg (GnuPG) 2.0.22; Copyright (C) 2013 Free Software Foundation, Inc. This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. How would you like to pay us? (1) Mastercard (2) VISA (3) Other Your selection? Also, a dark cynical pa…

> Also, a dark cynical part of me wants to ask exactly what the business model behind "free" SSL certs is? You're not paying them, someone else is?

Well, you never give them your private key, so… what could they possibly do??

Re: StartSSL, please revoke me – My private key has been compromised

#26

Post by __david__ »

achille wrote: post #6
tonylampada wrote: post #5

So now it's official. They got the evidence that the certificate is compromised yet they refuse to take action. If that's not violation of CA policy I don't know what is.

How dare they give you a free service, and then decide to charge for a revocation which they had said they would charge for (and is meaningless because by default all browsers ignore revocations). Unfortunately for various historical fuckups, we consider self signed certificates to be more dangerous than cleartext unsecured http. Lots of scary warnings pop up. That is absurd. Starcom is helping fix this by issuing fr…

> The Mozilla CA policy does not include a provision for obvious trolling and posturing. If Starcom were to be forced to revoke your certificate for free, why would anyone else (on any CA) ever pay for revocation?

This is not your garden variety, "I screwed up my .htaccess file and accidentally leaked my private key to the world" situation. This is a special case, and some special case rules would be really appreciated by this one, at least.

Re: StartSSL, please revoke me – My private key has been compromised

#27

Post by techsupporter »

taspeotis wrote: post #14
techsupporter wrote: post #12

Classic Big Lebowski moment: You're not wrong, you're just an asshole. Their stance is entirely correct. The customer used a file that StartCom provided in software that turns out to have had a security flaw. That's neither StartCom's problem nor liability. They didn't say "use this certificate with anything other than OpenSSL; you'll be sorry if you use OpenSSL," nor could they have foreseen it. On the other hand, s…

Their stance is entirely correct Well it sounds like their stance is wrong if they've agreed to the Mozilla CA Certificate Maintenance Policy: CAs must revoke Certificates that they have issued upon the occurrence of any of the following events: ... the CA obtains reasonable evidence that the subscriber’s private key (corresponding to the public key in the certificate) has been compromised

True, but all that violating that policy does is get them kicked out of Mozilla-operated software (at least directly; indirectly I suspect it causes a lot more hassle for them). Their internal rules say that a certificate revocation requires payment so, by their own rules, they are correct. If Mozilla comes down on them for their rules, StartCom may choose to modify those rules at their option.

Re: StartSSL, please revoke me – My private key has been compromised

#29

Post by claudius »

saurik wrote: post #9
lstamour wrote: post #7

I've used these guys in the past and quite like them, but yeah, this is poor PR and I hope they get pulled for not paying attention to, you know, the overall security of the trust product they're selling. I don't want lock-in on my SSL cert but it's effectively a contract if I have to pay a fee to break it and the SSL padlock on my domain is held hostage if I don't. Maybe someone should open a bug report on Bugzilla.…

So, to verify, would you rather pay a (smaller) fee upfront for every registration (effectively, insurance against revocation), rather than pay a (larger) fee if and only if you ever need to revoke? (Or, are you saying that StartSSL is somehow evil, because they refuse to do everything you ever wished they could do for you with no compensation of any kind?) (Is the issue simply that they won't revoke without a fee, e…

No, they are evil because they are lying to me.

When Mozilla put them in my browser, they promised “we will make sure that only people who own the domains get certs for them”. Now there are a bunch of people with leaked private keys and StartSSL is apparently doing nothing about them.

Note that I don’t care what StartSSL wants their “customers” to do, nor do I care what these “customers” want StartSSL to do, but I do care about private keys with associated valid StartSSL certificates floating around the internet, and it is not the responsibility of the owners of these keys to revoke the certs ASAP but StartSSL’s. Given that they don’t seem willing to do so, I’ll have to remove their CA from my browser.

One easy way out for “free certs” would be a clause like “If we have reasonable evidence that your certificate is compromised, we will revoke it immediately and you agree to pay a handling fee of 25 € for that.” in their Terms and Conditions. If such a clause would be illegal, I guess free certificates are just not feasible.

Re: StartSSL, please revoke me – My private key has been compromised

#30

Post by __david__ »

saurik wrote: post #9
lstamour wrote: post #7

I've used these guys in the past and quite like them, but yeah, this is poor PR and I hope they get pulled for not paying attention to, you know, the overall security of the trust product they're selling. I don't want lock-in on my SSL cert but it's effectively a contract if I have to pay a fee to break it and the SSL padlock on my domain is held hostage if I don't. Maybe someone should open a bug report on Bugzilla.…

So, to verify, would you rather pay a (smaller) fee upfront for every registration (effectively, insurance against revocation), rather than pay a (larger) fee if and only if you ever need to revoke? (Or, are you saying that StartSSL is somehow evil, because they refuse to do everything you ever wished they could do for you with no compensation of any kind?) (Is the issue simply that they won't revoke without a fee, e…

What I would rather have is a %$#@! CA cert signed by my registrar valid for *.my-domain.com for free. In what world should I have to pay annually for some asshole to run "openssl ca" on my behalf? Our whole CA system is bullshit.
Post reply on HN