41–50 of 75 posts
Too bad the author didn't issue certificates for, say, google.com, microsoft.com, and/or mozilla.org. That'd be a more likely way of getting those browser makers to put some restrictions or "sanctions" on them like Google recently did with Symantec.
Too bad the author didn't issue certificates for, say, google.com, microsoft.com, and/or mozilla.org. That'd be a more likely way of getting those browser makers to put some restrictions or "sanctions" on them like Google recently did with Symantec.
It's my understanding that pinning limits the damage of this sort of attack on those "big" sites.
When prompting for "postmaster", "hostmaster" or "webmaster", the values in that form should be just those and StartSSL should then put the two together ($MASTER_EMAIL + "@" + $DOMAIN.) They shouldn't assume that the "sendToEmail" value wasn't tampered with or overridden. If the original poster didn't include his screenshots or his steps then I wouldn't believe such a stupid mistake, especially one made by a certific…
For a while, I ran a small non-profit gaming site. This was well before Let's Encrypt, so we looked to StartSSL for a free certificate. They denied us. Why? Because we had links to a Paypal account set up to take donations. Even though PayPal had its own security, and we were only providing a link to it, that was enough for them to deny us the cert. They refused to understand that WE would be conducting no financial…
Good to know StartSSL is just as shoddy as it's always looked. Good thing we have letsencrypt these days.
It's interesting to me that so many people strongly dislike StartSSL that they won't even use their product for free.
That really goes to show how bad their service is.
Earlier quoted context omitted.
You would soon be left without any CAs. [1] People are pretty stupid when it comes to security, and this includes people working for CAs. There have been cases where the CA private key is publicly accessible to the internet without any password. [2] -- [1] Yes, plenty of smart people have been advocating moving away from the current CA system. It's fundamentally broken. [2] A great talk by moxie, filled with horror e…
Certificate Transparency with mandatory SCT delivery (as with EV certificates) will largely solve¹ the issue of fraudulent or compromised CAs. ¹ As long as you're monitoring CT log servers for anything involving domains you own.
Earlier quoted context omitted.
For a while, I ran a small non-profit gaming site. This was well before Let's Encrypt, so we looked to StartSSL for a free certificate. They denied us. Why? Because we had links to a Paypal account set up to take donations. Even though PayPal had its own security, and we were only providing a link to it, that was enough for them to deny us the cert. They refused to understand that WE would be conducting no financial…
Conversely, when I went for an SSL cert for my company, they called me (from Israel) on a phone number for our company taken from public sources, in order to verify we were who we were. Compare this to some other SSL providers, whose certification process is "can you give us $600?"
Interestingly, this blog author hasn't activated HTTPS for his own blog yet, which can be done with a single click on the Blogger settings page.
Why is that interesting?
The laid out attack cannot be used to attack the blog, because the blog is already so insecure.
Earlier quoted context omitted.
It's my understanding that pinning limits the damage of this sort of attack on those "big" sites.
I think what jlgaddis was trying to say is that by getting certificates issued for the major browser vendors, you're much more likely to get them to pull this CA out of the trust store.
Earlier quoted context omitted.
I think what jlgaddis was trying to say is that by getting certificates issued for the major browser vendors, you're much more likely to get them to pull this CA out of the trust store.
Yes, exactly. Thank you, I wasn't as clear as I could have been.
Good to know StartSSL is just as shoddy as it's always looked. Good thing we have letsencrypt these days.