Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Please remove StartCom Certification Authority root certificate

bugs.debian.org

Post reply on HN
Print view View original

41–48 of 48 posts

Re: Please remove StartCom Certification Authority root certificate

#41

Post by aidenn0 »

hansjorg wrote: post #32
chrramirez wrote: post #16

So, if StartCom is removed from trusted CAs you will have to buy a new certificate and spend $$$, something you obviously want to avoid. That's stupid.

It's an awfully sketchy business model. Like inverse insurance. That's not the issue though. Most people are not StartCom customers and couldn't care less. They still care about what that padlock icon signifies and that's why it's pertinent of large vendors to consider the CA status of StartCom in a situation like this.

> It's an awfully sketchy business model. Like inverse insurance.

You mean "Real Life" if I buy an item from manufacturer X, and it breaks due to a product from manufacturer Y (which almost everyone uses with the product I bought since it's complementary), it would be nice if manufacturer X would replace the item for free, but it's not sketchy or a dick move if they don't.

Re: Please remove StartCom Certification Authority root certificate

#42

Post by hansjorg »

aidenn0 wrote: post #41
hansjorg wrote: post #32

Earlier quoted context omitted.

It's an awfully sketchy business model. Like inverse insurance. That's not the issue though. Most people are not StartCom customers and couldn't care less. They still care about what that padlock icon signifies and that's why it's pertinent of large vendors to consider the CA status of StartCom in a situation like this.

> It's an awfully sketchy business model. Like inverse insurance. You mean "Real Life" if I buy an item from manufacturer X, and it breaks due to a product from manufacturer Y (which almost everyone uses with the product I bought since it's complementary), it would be nice if manufacturer X would replace the item for free, but it's not sketchy or a dick move if they don't.

No, not at all. That's not how SSL certificate revocation works.

If the certificate is not revoked when compromised, the party harmed may not be the StartCom customer, but anyone still trusting certificates issued by them.

When this is happening on a large scale, considering the CA status of StartCom is certainly due dilligence.

Re: Please remove StartCom Certification Authority root certificate

#43

Post by Karunamon »

aidenn0 wrote: post #40
Karunamon wrote: post #19

Earlier quoted context omitted.

And worse, the Debian developers would be at fault. This is a sticky situation, really. On one hand, StartCom's pricing structure is fairly upfront. On the other hand, extracting $25 from every customer because of a bug they have no control over is dick behavior of the highest order. Ideally they'd put out a notice saying that they will offer a one-time rekey for free. Without getting into ethics, it's an entirely au…

I use a StartCom certificate, but it has never been used with OpenSSL, so I'm fine. It costs money to maintain a CRL. Maybe they could revoke their intermediate certificate and reissue certificates to everyone. That would take time to coordinate, and every month that goes by 1/12 of the bad certs expire anyway.

It might, but certainly not $25 per instance. That feels a lot like gouging.

Re: Please remove StartCom Certification Authority root certificate

#44

Post by hansjorg »

mstrem wrote: post #27

Disclaimer: I have a number of free StartCom certificates. However, even though I own some certs with StartCom, I personally think this comment has literally no basis. Looking at the CA market - if anything - we should be happy that a CA like StartCom exists. It is a very small team lead by Eddy Nigg (he is very helpful by the way) and given that they are the ONLY ones (as far as I am aware) offering free certs - we…

Self signed certificates (i.e. free) are much better than a CA which won't revoke a certificate that's reported to be compromised.

Your customer relation to StartCom is irrelevant, this is about everybody else implicitly trusting them.

Re: Please remove StartCom Certification Authority root certificate

#45

Post by drdaeman »

derefr wrote: post #39
drdaeman wrote: post #38

Earlier quoted context omitted.

> moving the job of identity verification into OpenID identity providers Please, don't. This idea is horrible. With OpenID (and xAuth and Persona and whatever) your identity is provided, not asserted. This is very important distinction. I believe, any sane person wants to be a source of their identity (that's asserted by others), not to lease their very identity from a third party. If you want an identity - generate…

> If you want an identity - generate a keypair. Publish your public key and let others sign it to assert this keypair is genuinely yours. You're hiding an unbounded amount of work under the word "publish" there. The important part of an identity is the part where people trust that someone using the identity is you . Just posting "hey, this is the public key for John Smith" on a website does nothing to prove that fact…

> You're never the source of your identity.

I guess you're (or I'm, that's well possible too) mistaking identity with something other.

In my understanding, identities are what we - or part of us, as one could have multiple identities - are, not how we're called or what we look like. And names, personal or domain ones, are not identities but their properties. Others could assert your identity by confirming those properties (like when state issues a birth certificate with one's name in) or even associate their own information with person's identity (like assigning a trust level to a signature or limiting signature's timespan or, say, adding contract ID to a signature).

This is why OpenID and other attempts to shift identities from being owned (like one owns a certificate or password) to being merely leased doesn't look fancy to me.

Re: Please remove StartCom Certification Authority root certificate

#46

Post by BuildTheRobots »

Karunamon wrote: post #18
BuildTheRobots wrote: post #12

Not getting involved in the politics of being charged for revocations/re-keying, however it's worth pointing out that Google Chrome (linux and windows, and Chromium) all seem to have the "Check for server certificate revocation" option disabled by default.

In my experience, enabling it causes strange behavior with some plugins and even Chrome itself at some times. If the CRL check fails, related secure connections will fail with no notification . This led to a bit of problem with a proxy server at work. A filter update blocked the CRL link, and suddenly nobody in my office could sign into their Chrome browsers. You'd hit "log in", it would appear to work, but nothing h…

Interesting; thank you for the warning -This explains some of the oddness I've been having this morning after enabling it last night.

I went an checked firefox too which does check CRLs as default but doesn't silently fail if it can't check them (it's a separate tickbox)

Re: Please remove StartCom Certification Authority root certificate

#47

Post by maxerickson »

drdaeman wrote: post #45
derefr wrote: post #39

Earlier quoted context omitted.

> If you want an identity - generate a keypair. Publish your public key and let others sign it to assert this keypair is genuinely yours. You're hiding an unbounded amount of work under the word "publish" there. The important part of an identity is the part where people trust that someone using the identity is you . Just posting "hey, this is the public key for John Smith" on a website does nothing to prove that fact…

> You're never the source of your identity. I guess you're (or I'm, that's well possible too) mistaking identity with something other. In my understanding, identities are what we - or part of us, as one could have multiple identities - are, not how we're called or what we look like. And names, personal or domain ones, are not identities but their properties. Others could assert your identity by confirming those prope…

I'm in your camp, identity is an intrinsic property of a person. Documents provide variously worthwhile assertions about that identity (legally recognized name of depicted individual is...).

One key point in this is that an authentic document can be fraudulent (just takes a bit of corruption down at the office).

Re: Please remove StartCom Certification Authority root certificate

#48

Post by makomk »

blazespin wrote: post #33

Certificate revocation infrastructure (OSCP or CRL server) is something that needs to be maintained constantly (versus certificate requests, which are a one shot deal). In order to maintain that revocation, they have to keep serving it out for as long as someone might use your cert. It makes perfect sense to charge for it.

The certificate revocation infrastructure is something they're required to maintain in order for any of the browsers to actually accept their certificates, though.
Post reply on HN