Slashdot Mirror
Comodo Says Two More RAs Compromised
Trailrunner7 writes "Officials at Comodo have acknowledged that an additional two registration authorities affiliated with the company have been compromised in the wake of the high-profile attack on the company that was disclosed last week. Addressing a list of concerns about Comodo's practices raised by customers and browser vendors in the wake of the attack, Alden said that the company is now in the process of rolling out a new two-factor authentication system for its RAs. Comodo also is installing other security measures as a result of the attack."
Store the certificates in DNS, and access them with DNSSEC.
http://blog.fupps.com/2011/02/16/ssl-certificate-validation-and-dnssec/
I mean, few systems can avoid being compromised by a person with "experience of 1,000 hackers"
http://it.slashdot.org/story/11/03/28/2159202/Lone-Iranian-Claims-Credit-For-Comodo-Hack
So is "rolling out a new two factor authentication system" code for "our last two-factor authentication system consisted of 'something you know', your username, and 'something you know, your password; because, despite the fact that we are a fucking CA we just can't be bothered"?
Other than inertia, is there any reason to give these guys a second chance, rather than just drop them from the default trusted CAs list and let the company sell itself for scrap? Generating SSL certs is technologically trivial, anybody can do it at home with commonly available free software. Essentially, the only purpose of a CA is to be competent and trustworthy about who they generate certs for. CAs aren't really software or technology companies, they are much closer to the position of escrow services or trust companies. Generating certs is just the minor 'paperwork'. Generating only the right certs for only the right people is the job. If they can't do that, they are worse than useless.
Let's just hope they're not rolling out RSA Tokens :)
I have now removed Comodo as a trusted CA on my systems, and have advised colleagues of the three known occasions on which they have failed to act as a responsible CA. The game is up.
The Mozilla inclusion policy for maintaining CAs in the default list states that:
I hope that Mozilla now review the inclusion of Comodo's cert.
I used to get my SSL certs through Verisign or Thawte, who were quite expensive and required a truckload of paperwork to prove your identity to them when being issued a SSL certificate. This was years ago, so they may be more lax these days for all I know. I jumped to Comodo several years back because they were cheaper and had a lot less paperwork hassle. Generally I could get SSL certs more quickly through them than I could through Verisign or Thawte. I then managed enough SSL certs to get in to OpenSRS and I could issue SSL certs immediately with no paperwork whatsoever. I believe the small print in OpenSRS shifts the burden to you, not Comodo, to prove the identity of the organization requesting the SSL certificate. All my clients were local businesses and were easy enough for me to verify. Long story short, is that there are numerous ways around the identity verification schemes when obtaining SSL certificates. Perhaps with these recent SSL incidents the registration authorities and SSL issuers will start going back to the old days of putting people through the meatgrinder when trying to obtain SSL certificates. It may be inconvenient, but I think we've gotten to the point where the scales are tipped way too far in convenience's factor to the detriment of security and verification.
Didn't quite follow your third sentence there, but yeah, I'm de-listing Comodo and all Comodo-authorized CAs from my trusted list. We may not have perfect certificate revocation solutions, but that'll have to do for now.
Information theory is life. The rest is just the KL divergence.
The system of "certificate authority" on which SSL security ostensibly relies, has deteriorate to an essentially meaningless state.
This system is based primarily on trust. Trust requires at least a basic level of knowledge or understanding (this is a crucial difference between "trust" and "faith" :) ).
If you have not taken a look at your browser's "trusted certificate authority list" - now may be the time. I am a Firefox user, and I know that the list in Firefox contains numerous organizations with trustworthy names like "QuoVadis Limited", "TÜRKTRUST Elektronik Sertifika Hizmet Salaycs" and "XRamp Global Certification Authority". Do you know any of these companies? Do you personally have any reason to trust in their judgment, honesty or integrity?
For each company Firefox web site holds a document by some accounting firm (like the KPMG which has proven itself untrustworthy and unreliable even in matters of finance where they presumably have a clue) that purports to audit intentions and pracitces of said company wrt. issuance of said certificates. To put it simply that's worth as much as their audit of Lehman Brothers.
Bottom line - your browser essentially allows a random selection of highest bidders or politically connected entities to define what web sites are, in turn, to be trusted. It's pointless and there is little reason to believe that anything that say, sign or claim has any value whatsoever beyond the level of background noise.
Treat SSL the way you treat SSH - save specific certificates for sites, and watch for unexpected changes. Regardless of what the certificate or the "green location bar" say, don't trust them further than you can throw them.
Hell I'm removing all CA's from the browser as I don't trust any of them. Yes it creates a bit of an issue with some websites but all I have to do is add an exception for that site instead of blindly trusting the damn certificate.
What annoys me no end in Firefox is the fact that there is no simple way to disable all certs below a CA w/o having to disable each and everyone of them. This makes no sense. If I don't trust the Root CA then why in hell should I trust any of their subsidary CA's to be any better and why can't I uncheck a box for a Root CA and untrust the entire chain?
Mod me up/Mod me down: I wont frown as I've no crown
There is nothing wrong with the fact that many people can sign certificates. What is wrong is that there's no easy way to mark that up and control it and there are no ways to have multiple independent signing bodies. E.g. for financial transactions I would only want to trust a bank signed by an extended verification certificate from at least two registries + the government regulatory body of the country where the bank is registered. When I'm browsing slashdot I would probably be happy just to have a self signed certificate and get warned if it changed. What is needed is essentially a web of trust like PGP with a pre-loaded set of trusted bodies which varies according to the configuration of the user. There is no reason for a Chinese user to trust an American bank or the other way round.
With sufficiently clever defaults this could add quite a bit of security without any interaction or thinking from the user. They probably have to learn more about the colours of the address bar or something however.
=~ s,(.*),<sarcasm>$1</sarcasm>,g if any_point_you_wish();