Slashdot Mirror
Google Guillotine Falls on Certificate Authorities WoSign, StartCom (zdnet.com)
Google has warned that all certificates issued by Chinese company WoSign and subsidiary StartCom will be distrusted with the release of Chrome 61. From a report: According to a Google Groups post published by Chrome security engineer Devon O'Brien, due to "several incidents" involving the certificate authority which has "not [been] in keeping with the high standards expected of CAs," Google Chrome has already begun phasing out WoSign and StartCom by only trusting certificates issued prior to October 21, 2016. The tech giant is soon to go further and will completely distrust any certificate issued by the companies within a matter of months. The Chrome development team have restricted trust through a whitelist of hostnames which are based on the Alexa Top one million sites, and this list has been pruned down over the course of Chrome releases. Once version 61 is ready for public release, this will fully distrust any existing WoSign and StartCom root certificates and all certificates they have issued.
I'm glad there are people willing to stand up to corporate misbehavior. Now if only we could get some better way of doing revocation checks.
Custom electronics and digital signage for your business: www.evcircuits.com
Let's be honest: You shouldn't trust a certificate issues by anyone other than yourself. You don't think the U.S. government has ever colluded with a CA to set up a MITM attack before?
like because like fema camps like have like nothing to do with like guillotines like.
like because like fema camps like have like nothing to do with like guillotines like.
The government routinely orders guillotines (paper cutters). If you print out your certificate, you can cut it up with an office guillotine.
I don't know much about CAs. TFA says wosign issued bad certificates for github, and there were other issues. Is this incompetence or malice? Were they just overeager to sell certificates, are they catering to criminals, or is this likely to be some type of state-sponsored conspiracy to spy on secure websites?
Anyone else find it odd that the whitelist depends on the version? Like they hardcoded it?
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
Your position is actually a very reasonable. You don't know any of the certificate issuers. It is impossible for you to fully trust any of them. At most, you have some "policy" that supposedly tells you what some faceless corporation is doing.
Fortunately, people implemented solutions to this problem about a quarter century ago. "Moderately trust" your CAs. And if an identity is signed by (say) three moderately-trusted CAs then you consider it fairly trustworthy. You could even work in scoring rules for whether or not the CAs are jurisdictionally diverse enough. (e.g. If a Chinese signer and a US government signer and a French signer all agree, then either it's correct, or you are up against a conspiracy so massive that you'd never beat it anyway.)
What's the probability that someone is up to something naughty? Some fraction. Now raise that fraction to some more-than-1 power, say the third power. That's how trickable you'd be, if we used modern PK tech, like what PGP has.
It's the browsers that got us in the mess we're in. Browsers do the wrong thing with TLS in almost every situation.
We have really good crypto algorithms and protocols, and the implementations we have are confusing, misleading, and negate a lot of that functionality.
Pretty sure what you're describing has nothing to do with browsers. TLS is governed by the server, not the browser. Server dictates what crypto methods and hashing methods are permitted to be used. Browser has to comply with the server or get lost.
Us lowly commoners have to pay someone to sign our certs.
I don't pay for my cert. Let's Encrypt is free.
Why anyone should trust any cert not issued by a cert authority they personally control or vet and trust is beyond me.
The whole CA game is about a half step more legitimate than the TSA.
Oh great, another Google service that will probably be cancelled within a year
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
It wasn't just a few bad certs, there was a whole set of issues. Here is Mozilla's list: https://wiki.mozilla.org/CA:Wo...
Check out issue N, it is particularly bad.
we're nerd laughing with you
The thing everyone jumped on WoSign for was doing a customer a favour. Some significant Australian customer wasn't ready for SHA1 certificates being phased out and asked if WoSign could help them out. WoSign issued back-dated SHA1 certificates for the customer.
Yep - and I'm pretty sure we know who that customer was. There are still major institutions still using SHA1 certs internally - and if they get moved to newer ones by the end of the year then I'd be shocked. The reality is, this stinks of a scapegoat - the industry in question would face *MASSIVE* disruption for the everyday Australian because of the relatively quick move to higher level certs. A lot of these are still contained within embedded devices that cannot upgrade so easily.
Instead, let's execute the CA for political reasons. Don't pretend its anything else.
Looking through the list on Mozilla's list of WoSign Issues it looks like WoSign not just issued
but their setup also violated a number of other best practices and security measures too (such as unpatched servers). However I'll note that on the political front folks were unhappy that the Startcom acquisition wasn't made public earlier. Outside that though there are a lot of different technical complaints.
CA's have been dropped in the past for non-political problems (see DigiNotar) so I don't think it's fair to attribute WoSign's woes to purely political motivations as you alleged.
This really sucks for customers of StartCom (StartSSL):
Basically Google (and to a lesser extent Firefox) have handled this really badly. I found out about this issue when I got a new certificate and it wouldn't work: StartSSL certificate gives SEC_ERROR_REVOKED_CERTIFICATE in Firefox and ERR_CERT_AUTHORITY_INVALID in Chrome
StartSSL was the only certificate authority at its price point. You didn't have to pay by the certificate. You didn't have to pay for the automated process by which you validated ownership of domains. You only paid for validations of who you are and who your company is. Once you were validated, you could issue as many certificates as you wanted for any domains you own. For a flat fee of $200 per year, I could get all the certificates I needed.
The only alternative that I have been able to find is LetsEncrypt. While it is completely free it has some major disadvantages: