Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WoSign and StartCom: Mozilla’s proposed conclusion

docs.google.com

Post reply on HN
Print view View original

81–90 of 252 posts

Re: WoSign and StartCom: Mozilla’s proposed conclusion

#81

Post by ryan-c »

tptacek wrote: post #16

Mozilla and Chrome are killing StartCom. This is huge, isn't it? StartCom is one of the more popular CAs. Later: Additional fun fact: there's a decent-sized subthread on the mailing list in which it's strongly suggested that WoSign is itself quietly owned by Qihoo360, a much larger company --- somewhat like the Symantec of China. More specifically: https://twitter.com/pzb/status/780456712562024448

Qihoo360's browsers have awesome security: https://twitter.com/ryancdotorg/status/780470538686697472/ph...

Re: WoSign and StartCom: Mozilla’s proposed conclusion

#82

Post by justinclift »

TorKlingberg wrote: post #31
no_protocol wrote: post #7

A clear and detailed report. The conclusion seems both transparent and fair. It would be very difficult for many customers of StartCom/WoSign if they were immediately revoked. Hopefully this news spreads far enough that the reputation of StartCom/WoSign will generally include this information. I am saving this as a reference in the event I ever need to write a technical report. This style is so much easier to read th…

Yes, we are very fortunate to have Let's Encrypt now.

One problem - at least for the project I'm working on - is that Lets Encrypt isn't a replacement for all of StartCom.

We use a StartCom "MS Authenticode" certificate to sign our releases, so Windows users don't get a warning message from the various anti-malware scanners (and similar).

At first glance it sounds like Mozilla not accepting new StartCom cert's at some point won't affect that. It may snowball, but that's an unknown. o_O

Re: WoSign and StartCom: Mozilla’s proposed conclusion

#83

Post by pitay »

hayleox wrote: post #51
tarancato wrote: post #35

So I don't like Let's Encrypt, if Mozilla "kills" WoSign/StartCom, what are my options if I want a cert for free?

What exactly don't you like about Let's Encrypt? Besides Let's Encrypt, your other option is paying for a cert from GoDaddy or something. My two cents: don't give business to Comodo, given their horrible track record of sleaziness ( https://en.wikipedia.org/wiki/Comodo_Group#Controversies ).

My two cents: don't give business to Comodo, given their horrible track record of sleaziness (https://en.wikipedia.org/wiki/Comodo_Group#Controversies).

Funny you should mention that...

Look at the SSL certificate of this site.

Re: WoSign and StartCom: Mozilla’s proposed conclusion

#84

Post by Osmose »

gcp wrote: post #78
agwa wrote: post #62

Earlier quoted context omitted.

Ryan Sleevi authored the report in his capacity as a peer of the Mozilla CA Certificates Module, not as a Chrome/Google employee. See https://wiki.mozilla.org/CA:Policy_Participants Chrome does indeed use the platform CA store, but they can and do impose additional logic on top of it, such as requiring CT for Symantec, distrusting new CNNIC certs, or name-constraining ANSSI and India CCA.

Yes, but it begs the question why a Google employee working on Chromium is a peer of that module in the first place. It's because Google is a user, right?

It's not because Google is a user, but rather because he has contributed a significant amount to the part of the Mozilla project that that module covers. That's generally how module peers and owners are nominated / chosen.

Now the fact that he is an employee working on Chromium may be the reason why he ended up contributing to that part of Mozilla a bunch, but it's not supposed to be "Google gets a peer on the CA module".

Re: WoSign and StartCom: Mozilla’s proposed conclusion

#85

Post by bratch »

joseignaciorc wrote: post #21

Just curiosity: since this report is a Google Doc, how can one know that it has been really written by Mozilla? Shouldn't it be under the mozilla.org domain?

Being hosted where it is is particularly annoying because you can't view it unless you accept cookies from google.com.

A JavaScript redirect takes you straight to https://support.google.com/accounts/answer/32050.

Re: WoSign and StartCom: Mozilla’s proposed conclusion

#86

Post by aroch »

justinclift wrote: post #82
TorKlingberg wrote: post #31

Earlier quoted context omitted.

Yes, we are very fortunate to have Let's Encrypt now.

One problem - at least for the project I'm working on - is that Lets Encrypt isn't a replacement for all of StartCom. We use a StartCom "MS Authenticode" certificate to sign our releases, so Windows users don't get a warning message from the various anti-malware scanners (and similar). At first glance it sounds like Mozilla not accepting new StartCom cert's at some point won't affect that. It may snowball, but that's…

NSS can forcibly set trust bits for certificate chains -- so in theory they could set the codesigning only trustbit.

ButI'm pretty sure Windows is not using NSS as its truststore for those checks. So its up to Microsoft to deal with the de-trusting (which may or may not be modular, I have no idea).

Re: WoSign and StartCom: Mozilla’s proposed conclusion

#87

Post by agwa »

gcp wrote: post #78
agwa wrote: post #62

Earlier quoted context omitted.

Ryan Sleevi authored the report in his capacity as a peer of the Mozilla CA Certificates Module, not as a Chrome/Google employee. See https://wiki.mozilla.org/CA:Policy_Participants Chrome does indeed use the platform CA store, but they can and do impose additional logic on top of it, such as requiring CT for Symantec, distrusting new CNNIC certs, or name-constraining ANSSI and India CCA.

Yes, but it begs the question why a Google employee working on Chromium is a peer of that module in the first place. It's because Google is a user, right?

The decision by Mozilla has absolutely no bearing on Chromium. Although Chromium indirectly uses the NSS root store when run on a Linux distro that uses the NSS root store, the logic proposed by Mozilla will be implemented at a higher layer than the root store, meaning Chromium won't be affected by it.

Re: WoSign and StartCom: Mozilla’s proposed conclusion

#88

Post by Negitivefrags »

I'm not going to defend WoSign/StartCom's shady tactics, but the way the deprecation of SHA1 was performed puts people in a pretty shitty position.

You can't support Windows XP users who use IE anymore with HTTPs.

In the western world, that number is very small. It's around 1% still using XP and most of those people are probably not using IE anymore.

In china though, that number is still >5%, and I got that number personally from the metrics of a game that we just deployed an alpha for in China. I would bet that given the way the alpha test keys were handed out that the amount of Windows XP users in the general population is probably much much higher.

So what is the response if you can't support a significant portion of your user base? Well for a bunch of chinese websites the result is don't use HTTPS at all. We have seen advice that "HTTPS cases problems for users in China so we think it's a bad idea to use it". It's not a good situation.

Re: WoSign and StartCom: Mozilla’s proposed conclusion

#89

Post by jvehent »

Negitivefrags wrote: post #88

I'm not going to defend WoSign/StartCom's shady tactics, but the way the deprecation of SHA1 was performed puts people in a pretty shitty position. You can't support Windows XP users who use IE anymore with HTTPs. In the western world, that number is very small. It's around 1% still using XP and most of those people are probably not using IE anymore. In china though, that number is still >5%, and I got that number pe…

> You can't support Windows XP users who use IE anymore with HTTPs.

Sure you can. Just ask a CA that has an old root trusted by XP but no longer trusted by modern browsers, and they'll issue a SHA-1 cert for you without risking to get kicked out of the truststores.

Re: WoSign and StartCom: Mozilla’s proposed conclusion

#90

Post by Negitivefrags »

jvehent wrote: post #89
Negitivefrags wrote: post #88

I'm not going to defend WoSign/StartCom's shady tactics, but the way the deprecation of SHA1 was performed puts people in a pretty shitty position. You can't support Windows XP users who use IE anymore with HTTPs. In the western world, that number is very small. It's around 1% still using XP and most of those people are probably not using IE anymore. In china though, that number is still >5%, and I got that number pe…

> You can't support Windows XP users who use IE anymore with HTTPs. Sure you can. Just ask a CA that has an old root trusted by XP but no longer trusted by modern browsers, and they'll issue a SHA-1 cert for you without risking to get kicked out of the truststores.

And what about all the modern browsers you also need to support?
Post reply on HN