3 ms·

The author doesn't say why this is worrisome. He just says he's worried "that the PKI front-end (auth.startssl.com) is now hosted within a Chinese Antivirus Co

The author doesn't say why this is worrisome. He just says he's worried "that the PKI front-end (auth.startssl.com) is now hosted within a Chinese Antivirus Company, who uses a Chinese ISP for 2 months and that there hasn't been any news around". The article could certainly use a bit more connecting-the-dots to show how he gets from "they're hosted in China" to "I won't use them anymore".

taneq 11y ago
I think the implication is that the Chinese government exerts a lot of control over the internet there, and are openly monitoring/intercepting internet traffic. As such, they shouldn't be considered a trusted authority for security related purposes.
- Laforet 11y ago
  Your concern is well placed but the linked post really missed the point. Signing authorities in X509 don't have access to private keys and they don't really need domain owner's input to sign a MITM cert. Most software that uses TLS nowadays ships with a number of CA root certs sponsored by various nation states including China. On desktop they can be disabled but iOS drvices are out of luck (or perpetually compromised in a sense) http://slashdot.org/story/266739 http://slashdot.org/story/266739
  - subway 11y ago
    By default, StartSSL's wizard generates private keys for you. (Providing your own key is of course an option).
    - 0x0 11y ago
      For the higher account levels, they also require uploaded scans/photos of sensitive ID documents like passports / drivers' licenses.
      - Laforet 11y ago
        Yes, that's a problem. If a company starts to ask for this sort of information I will refuse unless there are no alternatives. Trusting a CA to provide your private key is on another matter.
      - pluma 11y ago
        There are people who use StartSSL for paid certificates? I though the free certs were the only reason people put up with their craptacular website.
        0x0 11y ago
        It used to be a pretty sweet deal, for $60 you could get unlimited multi-domain multi-wildcard certs. Most other CAs charged more than that for a single wildcard cert, and noone else seems to even offer multiple wildcard domains in a single cert. Which was quite sensible, actually. Charge for the actual costly process of manually verifying ID, and then allow for unlimited free domain-validations to be issued to the corresponding ID (which is the machine-automatable part).
        deleted 11y ago
        [deleted]
        kennycox 11y ago
        After searching the web and comparing the different price rates, I just found a lowest wildcard SSL at $42/yr. at https://www.ssl2buy.com https://www.ssl2buy.com. I hope that you would not find cheaper than this wildcard SSL. As they did not charge any extra beyond the price and helped me to secure my number of sub domains. Even the backend technical support was good enough.
    - Tepix 11y ago
      I agree that's sneaky. I would never use that feature - it's an invitation to do MITM attacks later on. When I first saw the form with this option on their website I thought "oh so that's why the Mossad is running this CA for free..."
- pluma 11y ago
  I'm not convinced that is any more worrisome than the US situation as long as you don't trust them with your private keys. The US also monitors/intercepts internet traffic, except they do so (pre-Snowden anyway) secretly. They actually do a lot of things China gets accused of -- just think of the CISCO router "upgrade" facility.

taneq 11y ago

I think the implication is that the Chinese government exerts a lot of control over the internet there, and are openly monitoring/intercepting internet traffic. As such, they shouldn't be considered a trusted authority for security related purposes.

Laforet 11y ago
Your concern is well placed but the linked post really missed the point. Signing authorities in X509 don't have access to private keys and they don't really need domain owner's input to sign a MITM cert. Most software that uses TLS nowadays ships with a number of CA root certs sponsored by various nation states including China. On desktop they can be disabled but iOS drvices are out of luck (or perpetually compromised in a sense) http://slashdot.org/story/266739 http://slashdot.org/story/266739
- subway 11y ago
  By default, StartSSL's wizard generates private keys for you. (Providing your own key is of course an option).
  - 0x0 11y ago
    For the higher account levels, they also require uploaded scans/photos of sensitive ID documents like passports / drivers' licenses.
    - Laforet 11y ago
      Yes, that's a problem. If a company starts to ask for this sort of information I will refuse unless there are no alternatives. Trusting a CA to provide your private key is on another matter.
    - pluma 11y ago
      There are people who use StartSSL for paid certificates? I though the free certs were the only reason people put up with their craptacular website.
      - 0x0 11y ago
        It used to be a pretty sweet deal, for $60 you could get unlimited multi-domain multi-wildcard certs. Most other CAs charged more than that for a single wildcard cert, and noone else seems to even offer multiple wildcard domains in a single cert. Which was quite sensible, actually. Charge for the actual costly process of manually verifying ID, and then allow for unlimited free domain-validations to be issued to the corresponding ID (which is the machine-automatable part).
        deleted 11y ago
        [deleted]
        kennycox 11y ago
        After searching the web and comparing the different price rates, I just found a lowest wildcard SSL at $42/yr. at https://www.ssl2buy.com https://www.ssl2buy.com. I hope that you would not find cheaper than this wildcard SSL. As they did not charge any extra beyond the price and helped me to secure my number of sub domains. Even the backend technical support was good enough.
  - Tepix 11y ago
    I agree that's sneaky. I would never use that feature - it's an invitation to do MITM attacks later on. When I first saw the form with this option on their website I thought "oh so that's why the Mossad is running this CA for free..."
pluma 11y ago
I'm not convinced that is any more worrisome than the US situation as long as you don't trust them with your private keys. The US also monitors/intercepts internet traffic, except they do so (pre-Snowden anyway) secretly. They actually do a lot of things China gets accused of -- just think of the CISCO router "upgrade" facility.