31–40 of 48 posts
Solution 3: cease trusting StartSSL certs issued before 2014-04-07? This is implied by the request itself but is it possible to implement?
So, if StartCom is removed from trusted CAs you will have to buy a new certificate and spend $$$, something you obviously want to avoid. That's stupid.
That's not the issue though. Most people are not StartCom customers and couldn't care less.
They still care about what that padlock icon signifies and that's why it's pertinent of large vendors to consider the CA status of StartCom in a situation like this.
Either this request is naive, or I am. As I understand it, not all StartCom certificates are necessarily vulnerable. I have a number of StartSSL certificates issued before 4/7 that, according to the HeartBleed checker here[1] are not vulnerable. Is it wrong for me to assume that the tool is correct, or is it wrong to assume that all StartCom certificates are necessarily vulnerable? [1] - http://filippo.io/Heartbleed/
What that tool says is irrelevant to the question of whether those certs have been compromised. The risk is that before the vulnerability was patched, somebody used it to grab the private keys associated with the certs.
Solution 3: cease trusting StartSSL certs issued before 2014-04-07? This is implied by the request itself but is it possible to implement?
Disclaimer: I have a number of free StartCom certificates. However, even though I own some certs with StartCom, I personally think this comment has literally no basis. Looking at the CA market - if anything - we should be happy that a CA like StartCom exists. It is a very small team lead by Eddy Nigg (he is very helpful by the way) and given that they are the ONLY ones (as far as I am aware) offering free certs - we…
Earlier quoted context omitted.
What that tool says is irrelevant to the question of whether those certs have been compromised. The risk is that before the vulnerability was patched, somebody used it to grab the private keys associated with the certs.
But what if the key was never used with openssl or heartbeat?
please remove all CA root certificate becaue they all charge fees for certs and that discourages spreading TLS and https more broadly?
StartCom almost has the right idea with the way they do EV certs: they charge you for identity verification (the thing that actually requires human labor to do), and then the EV certs themselves (as many as you like, for as long as you like) are free. I think the optimal thing would be moving the job of identity verification into OpenID identity providers. So you could create a plain OpenID identity, or pay for a ver…
Please, don't. This idea is horrible.
With OpenID (and xAuth and Persona and whatever) your identity is provided, not asserted. This is very important distinction. I believe, any sane person wants to be a source of their identity (that's asserted by others), not to lease their very identity from a third party.
If you want an identity - generate a keypair. Publish your public key and let others sign it to assert this keypair is genuinely yours. It's that easy. (Although, sadly, X.509 doesn't support multiple signatures, so one can't do a proper web-of-trust with them.)
If you want automated domain ownership verification and completely automated certificate signing (and whois-pointed email ownership check is not to your taste) - well, how about putting a CSR right in TXT record of the domain? CA-bot would see those and sign them. No need for identity providers except for a domain registrar.
Earlier quoted context omitted.
StartCom almost has the right idea with the way they do EV certs: they charge you for identity verification (the thing that actually requires human labor to do), and then the EV certs themselves (as many as you like, for as long as you like) are free. I think the optimal thing would be moving the job of identity verification into OpenID identity providers. So you could create a plain OpenID identity, or pay for a ver…
> moving the job of identity verification into OpenID identity providers Please, don't. This idea is horrible. With OpenID (and xAuth and Persona and whatever) your identity is provided, not asserted. This is very important distinction. I believe, any sane person wants to be a source of their identity (that's asserted by others), not to lease their very identity from a third party. If you want an identity - generate…
You're hiding an unbounded amount of work under the word "publish" there. The important part of an identity is the part where people trust that someone using the identity is you. Just posting "hey, this is the public key for John Smith" on a website does nothing to prove that fact. (Key-signing parties prove that fact, but people don't do those.)
What does prove that fact is the background-check a CA does. But they only do it to create a private notion of your identity for themselves, which means that every CA has to do its own redundant background check, which is why certs cost money.
All I'm suggesting, here, is that the "background checking to create an ID number that maps to a specific person" part could be split off into its own business model, and the resulting ID number (in the form of an OpenID, or whatever else) reused by any-and-all organizations that wish to map tokens to real people.
Also:
> I believe, any sane person wants to be a source of their identity (that's asserted by others), not to lease their very identity from a third party.
You're never the source of your identity. For example, your name is only your name because the government you were born under has a law creating an identity, by mapping birth certificates to people, and your name is one aspect of that identity. Change citizenship from the US to China? Suddenly what you were considering "your name" is no more, and your new name is spelled in ideographs. You can certainly get people to call you by your old, alphabetic name--but that is a person-to-token mapping. In any token-to-person mapping--a phonebook, for example--you'll be found by your new government-created identity.
So, if StartCom is removed from trusted CAs you will have to buy a new certificate and spend $$$, something you obviously want to avoid. That's stupid.
And worse, the Debian developers would be at fault. This is a sticky situation, really. On one hand, StartCom's pricing structure is fairly upfront. On the other hand, extracting $25 from every customer because of a bug they have no control over is dick behavior of the highest order. Ideally they'd put out a notice saying that they will offer a one-time rekey for free. Without getting into ethics, it's an entirely au…
It costs money to maintain a CRL.
Maybe they could revoke their intermediate certificate and reissue certificates to everyone. That would take time to coordinate, and every month that goes by 1/12 of the bad certs expire anyway.