Slashdot Mirror
Microsoft Dumps Notorious Chinese Secure Certificate Vendor (zdnet.com)
Soon, neither Internet Explorer nor Edge will recognize new security certificates from Chinese Certificate Authorities WoSign and its subsidiary StartCom. ZDNet reports: A CA is a trusted entity that issues X.509 digital certificates that verify a digital entity's identity on the internet. Certificates include its owner's public key and name, the certificate's expiration date, encryption method, and other information about the public key owner. Typically, these are used to secure websites with the https protocol, lock down internet communications with Secure Sockets Layer and Transport Layer Security (SSL/TLS), and secure virtual private networks (VPNs). A corrupted certificate is barely better than no protection at all. It can be used to easily hack websites and "private" internet communications.
Microsoft has joined [Mozilla, Google and Apple] in abandoning trust in their certificates. A Microsoft representative wrote: "Microsoft has concluded that the Chinese CAs WoSign and StartCom have failed to maintain the standards required by our Trusted Root Program. Observed unacceptable security practices include back-dating SHA-1 certificates, mis-issuances of certificates, accidental certificate revocation, duplicate certificate serial numbers, and multiple CAB Forum Baseline Requirements (BR) [issuance and management rules for public certificates] violations." Microsoft will start "the natural deprecation of WoSign and StartCom certificates by setting a 'NotBefore' date of 26 September 2017. This means all existing certificates will continue to function until they self-expire. Windows 10 will not trust any new certificates from these CAs after September 2017."
Microsoft has joined [Mozilla, Google and Apple] in abandoning trust in their certificates. A Microsoft representative wrote: "Microsoft has concluded that the Chinese CAs WoSign and StartCom have failed to maintain the standards required by our Trusted Root Program. Observed unacceptable security practices include back-dating SHA-1 certificates, mis-issuances of certificates, accidental certificate revocation, duplicate certificate serial numbers, and multiple CAB Forum Baseline Requirements (BR) [issuance and management rules for public certificates] violations." Microsoft will start "the natural deprecation of WoSign and StartCom certificates by setting a 'NotBefore' date of 26 September 2017. This means all existing certificates will continue to function until they self-expire. Windows 10 will not trust any new certificates from these CAs after September 2017."
If it sounds too good to be true, it probably is.
Table-ized A.I.
Setting NotBefore will expire all current certificates and allow WoSign and StartCom to issue certificates that will be trusted in the future. Setting NotAfter will no longer trust these certs in the future. Hopefully, the Microsoft engineers are more attentive than ZDNet writers and editors.
Wosign's work is clearly done now and presumably the Chinese government will move on to another certificate vendor.
The real "Libtards" are the Libertarians!
Book 'im, Danno!
Observed unacceptable security practices include back-dating SHA-1 certificates
Windows 10 will not trust any new certificates from these CAs after September 2017.
So what's to prevent them from back dating new certificates?
Are there any CA cert bundles that only contain certs for CAs from first-world nations?
By that I mean the United States, Canada, Australia, New Zealand, the UK, Ireland, the nations of west/central/north Europe, and Japan.
I don't want to trust any CA outside of those regions, and perhaps even some within those regions.
I have no reason to ever need to trust a cert associated with a CA from China, or India, or Turkey, or any African or South American nation, for example. I'd rather get a cert warning when I access a site that happens to use a cert from such a CA.
There should be a Debian package that installs a cert bundle like this, instead of me having to prepare it myself.
>> A CA is a trusted entity that issues X.509 digital certificates that verify a digital entity's identity on the internet.
>> Certificates include its owner's public key and name, the certificate's expiration date, encryption method, and
>> other information about the public key owner. Typically, these are used to secure websites with the https
>> protocol, lock down internet communications with Secure Sockets Layer and Transport Layer Security
>> (SSL/TLS), and secure virtual private networks (VPNs).
>> A corrupted certificate is barely better than no protection at all.
>> It can be used to easily hack websites and "private" internet communications.
Perhaps it is just the wording; however I'd be far more concerned about a incorrectly issued certificate than a corrupted one ... After all you should trust me because I really am from Google, Apple, .
I'm on it!
It has been a story here multiple times over the past 2 months, each time another browser drops them it gets a story here. They are also by no means the last as still quite a few to go, maybe the last of the large marketshare ones.
What good is https if you can't trust the certs?
In today's world any system based on trust is just not sustainable. What we need is verification, not trust.
“He’s not deformed, he’s just drunk!”
If Toneport acts as a dongle, then some subroutines (or functions) are stored inside that Toneport. Possible solution is to R.E. the Toneport then extract the subroutines and dump it into a binary blob into your hard disk and which would be called by the plug-in. Requires low level assembly language and cracking a dongle is one the most difficult task for any reverser.
I used StartCom's free certs for years with no problem. First I hear of WoSign it's that they bought out StartCom and ruined it. It's a real shame, and Let's Encrypt is no alternative. I'd rather pay for a year cert than put up with a few months.
== Jez ==
Do you miss Firefox? Try Pale Moon.
Quite frankly, that probably means that WoSign was unwilling to issue faked certificates for the NSA or that they failed to hack it. Sure, it _will_ issue faked certificates for the Chinese Government, but the security arguments cited are nonsense. Various saboteurs (a strong contributor the US) have ensured that "official" certificates are worthless.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
... but not the rest of us.
I love stacking my barbecues in the shed at the end of summer - you can't beat a bit of grill on grill action.
Who would be dumb enough to get something signed by a company called WhoaSign!
What, if anything, does that mean for their code-signing certificates?
While admittedly not being time-stamped is a disadvantage (though if you regularly publish updates not so much), I don't think you can get a 3-year code-signing certificate for $50 anywhere else.
In fact, as a private developer you'll have a hard time getting a code-signing certificate at any price since the vast majority of offerings are only for organizations.
It is even worse for websites, it seems NOBODY offers certificates for individuals at any price (I mean not just domain validated, but actually in your name).
I don't want to trust any CA outside of those regions, and perhaps even some within those regions.
Your assumption that CAs can be considered trustworthy by default simply because they're in countries you like is charming. Dangerous, but charming.
Windows 10 will not trust any new certificates from these CAs after September 2017."
Seriously.... you're going to rely on the CA's NotBefore date to decide to invalidate the cert?
Did you forget that this CA doesn't participate in certificate transparency AND NotBefore date can
technically be set to whatever the CA wants?
The so-called "Backdating certificates" issue, Although in reality, the NotBefore date is not an issuance date;
it's a date before which the certificate should be treated as an invalid credential.
When you have an object with authenticated timestamp such as signed code, this distinction could be important,
but certificates valid only for TLS aren't used for such, so usually NotBefore is the time of issuance; however,
no guarantees.
Certainly no technical restraint on the CA.....