The story of how WoSign gave me an SSL certificate for GitHub

#1

Post by schrauger » Wed, Aug 31, 2016, 10:22 PM UTC

The story of how WoSign gave me an SSL certificate for GitHub
schrauger.com

Re: The story of how WoSign gave me an SSL certificate for GitHub

#2

Post by daxelrod » Wed, Aug 31, 2016, 10:55 PM UTC

This is great additional detail on the WoSign fiasco. Also discussed yesterday here: https://news.ycombinator.com/item?id=12389573

Re: The story of how WoSign gave me an SSL certificate for GitHub

#3

Post by 0x0 » Wed, Aug 31, 2016, 11:00 PM UTC

Their policy page at http://www.wosign.com/policy/ currently renders backend source code in plain text...

Re: The story of how WoSign gave me an SSL certificate for GitHub

#4

Post by jontro » Wed, Aug 31, 2016, 11:01 PM UTC

0x0 wrote: post #3

Their policy page at http://www.wosign.com/policy/ currently renders backend source code in plain text...

http://www.wosign.com/policy/cps_e.htm if you parse the source :p

Re: The story of how WoSign gave me an SSL certificate for GitHub

#5

Post by ryanmarsh » Wed, Aug 31, 2016, 11:17 PM UTC

Stuff like this is depressing. Are we ever going to have any semblance of privacy and security on the Internet?

Everyone has been hacked, political figures, governments, businesses. In 100 years I think people are going to look back on this time and think we were all crazy like how we see safety in the early auto industry.

Re: The story of how WoSign gave me an SSL certificate for GitHub

#6

Post by cpeterso » Thu, Sep 01, 2016, 12:17 AM UTC

0x0 wrote: post #3

Their policy page at http://www.wosign.com/policy/ currently renders backend source code in plain text...

And it's VBScript!

  0 then
  Response.Redirect "cps.htm" else Response.Redirect "cps_e.htm" end if %>

Re: The story of how WoSign gave me an SSL certificate for GitHub

#7

Post by est » Thu, Sep 01, 2016, 1:55 AM UTC

So OP mentioned a question posted to stackexchange, clicked link, expected closed.

https://security.stackexchange.com/questions/91292/

LOL good ol' stackexchange, closed as duplicate.

Re: The story of how WoSign gave me an SSL certificate for GitHub

#8

Post by schrauger » Thu, Sep 01, 2016, 2:31 AM UTC

est wrote: post #7

So OP mentioned a question posted to stackexchange, clicked link, expected closed. https://security.stackexchange.com/questions/91292/ LOL good ol' stackexchange, closed as duplicate.

Yeah, I still think it shouldn't be considered a duplicate. Especially since going directly to WoSign didn't end up solving the overall problem, which is what the linked duplicate question says to do.

Re: The story of how WoSign gave me an SSL certificate for GitHub

#9

Post by hughw » Thu, Sep 01, 2016, 2:42 AM UTC

The root cert for www.schrauger.com is StartCom Certificate Authority. Isn't it their (StartCom's) responsibility to make sure the owner of Certification Authority of WoSign (the next cert in the chain) is acting in accord with some terms and conditions? Secondly, should the browser vendors remove StartCom CA as a trusted root? Do they not do that because all the StsrtSSL sites would break? Fine with me, personally.

[Edited to clarify who "their" meant]

Re: The story of how WoSign gave me an SSL certificate for GitHub

#10

Post by contingencies » Thu, Sep 01, 2016, 2:44 AM UTC

cpeterso wrote: post #6

0x0 wrote: post #3

Their policy page at http://www.wosign.com/policy/ currently renders backend source code in plain text...

And it's VBScript! 0 then Response.Redirect "cps.htm" else Response.Redirect "cps_e.htm" end if %>

So much of China runs on Windows scripting it's horrific. That is changing, but slowly.