3 ms·

A vulnerability of this level is inexcusable. StartSSL ought to be removed from all major browsers.

by keketi 11y ago

nabaraz 11y ago
Agreed. The more I hear about StartSSL the more I want to run away.
y0ghur7_xxx 11y ago
I agree. What certificates have been issued until now fraudulently like this? Does SartSSL submit certificates to Certificate Transparency? And if it does, who knows if there is a bug in that code too, and certs have not been submitted? Mozilla, Google, Apple and Microsoft should remove this CA ASAP. If it breaks some sites, even better. Maybe it will make some noise and fix all this CA bullshit for good.
- d33 11y ago
  IMHO this could be handled more safely: suspend or remove the acceptation of any StartSSL certificates issued after a given date. This should give them some more accountability.
Animats 11y ago
Right now, StartSSL needs to do a quick search on their database to see which certs had email sent to a domain other than the one for which the cert applies. All such certs should be revoked immediately, and the owners of the domains involved notified of the breach. Also, did they check properly for TLD and subdomain issues? If I have "me.blogspot.com", can I get a cert for "blogspot.com"? (What's a TLD today? It's complicated. See "https://publicsuffix.org/" https://publicsuffix.org/")
- kevincox 11y ago
  StartSSL only allows validation for top level domains. So you can't get a cert for me.blogspot.com unless you own blogspot.com.
  - kiallmacinnes 11y ago
    I think you entirely missed his point. What about blogspot.co.uk? Do you need to own that, or co.uk to get a cert? What counts as a "top level domain" is, as Animats said, complicated.
    - kevincox 11y ago
      Oh ok. I can't attest to how this is handled because I have never attempted to get a cert for a domain like this.
Strom 11y ago
You would soon be left without any CAs. [1] People are pretty stupid when it comes to security, and this includes people working for CAs. There have been cases where the CA private key is publicly accessible to the internet without any password. [2] -- [1] Yes, plenty of smart people have been advocating moving away from the current CA system. It's fundamentally broken. [2] A great talk by moxie, filled with horror examples of CAs. The private key example is at 19:20. https://www.youtube.com/watch?v=Z7Wl2FW2TcA https://www.youtube.com/watch?v=Z7Wl2FW2TcA
- pfg 11y ago
  Certificate Transparency with mandatory SCT delivery (as with EV certificates) will largely solve¹ the issue of fraudulent or compromised CAs. ¹ As long as you're monitoring CT log servers for anything involving domains you own.
  - technion 11y ago
    Obligatory reference to my CT monitoring service: https://ctadvisor.lolware.net/ https://ctadvisor.lolware.net/

A vulnerability of this level is inexcusable. StartSSL ought to be removed from all major browsers.

by keketi 11y ago

A vulnerability of this level is inexcusable. StartSSL ought to be removed from all major browsers.

nabaraz 11y ago

Agreed. The more I hear about StartSSL the more I want to run away.

y0ghur7_xxx 11y ago

I agree. What certificates have been issued until now fraudulently like this? Does SartSSL submit certificates to Certificate Transparency? And if it does, who knows if there is a bug in that code too, and certs have not been submitted? Mozilla, Google, Apple and Microsoft should remove this CA ASAP. If it breaks some sites, even better. Maybe it will make some noise and fix all this CA bullshit for good.

d33 11y ago
IMHO this could be handled more safely: suspend or remove the acceptation of any StartSSL certificates issued after a given date. This should give them some more accountability.

Animats 11y ago

Right now, StartSSL needs to do a quick search on their database to see which certs had email sent to a domain other than the one for which the cert applies. All such certs should be revoked immediately, and the owners of the domains involved notified of the breach. Also, did they check properly for TLD and subdomain issues? If I have "me.blogspot.com", can I get a cert for "blogspot.com"? (What's a TLD today? It's complicated. See "https://publicsuffix.org/" https://publicsuffix.org/")

kevincox 11y ago
StartSSL only allows validation for top level domains. So you can't get a cert for me.blogspot.com unless you own blogspot.com.
- kiallmacinnes 11y ago
  I think you entirely missed his point. What about blogspot.co.uk? Do you need to own that, or co.uk to get a cert? What counts as a "top level domain" is, as Animats said, complicated.
  - kevincox 11y ago
    Oh ok. I can't attest to how this is handled because I have never attempted to get a cert for a domain like this.

Strom 11y ago

You would soon be left without any CAs. [1] People are pretty stupid when it comes to security, and this includes people working for CAs. There have been cases where the CA private key is publicly accessible to the internet without any password. [2] -- [1] Yes, plenty of smart people have been advocating moving away from the current CA system. It's fundamentally broken. [2] A great talk by moxie, filled with horror examples of CAs. The private key example is at 19:20. https://www.youtube.com/watch?v=Z7Wl2FW2TcA https://www.youtube.com/watch?v=Z7Wl2FW2TcA

pfg 11y ago
Certificate Transparency with mandatory SCT delivery (as with EV certificates) will largely solve¹ the issue of fraudulent or compromised CAs. ¹ As long as you're monitoring CT log servers for anything involving domains you own.
- technion 11y ago
  Obligatory reference to my CT monitoring service: https://ctadvisor.lolware.net/ https://ctadvisor.lolware.net/