3 ms·

> Google detecting further abuse of notBefore via Certificate Transparency You don't need to rely on Google. All certs issued by WoSign since January 1st, 2015

by xnyhps 10y ago

> Google detecting further abuse of notBefore via Certificate Transparency You don't need to rely on Google. All certs issued by WoSign since January 1st, 2015 should be on WoSign's own Certificate Transparency log from which you can download them. StartCom is logging all new certs too, but I don't know for sure if they pushed all older ones too. If you ever encounter a cert that isn't on the list, that's definitive proof that they are backdating again. The list of certificates is too large for Mozilla to include a list of hashes in Firefox, but it might be a nice opportunity for a Firefox add-on.

dspillett 10y ago
> You don't need to rely on Google ... should be on WoSign's own Certificate Transparency log which you can download Given that the behaviours being documented include falsifying data (backdating certificates to get around SHA1 retirement), I would prefer to at least use information from Google (or another third party) for the purpose of verification, rather than just relying on information sourced from WoSign/StartCom.
- xnyhps 10y ago
  They can't backdate their Certificate Transparency log without leaving cryptographic evidence behind. That's how CT is designed to work. Of course, simply being in the log doesn't imply the cert was issued correctly, but the logs have been posted for a couple of months now and have received a lot of scrutiny during Mozilla's investigation. But the same is true for Google's log, presence in that log is also no guarantee that it was issued correctly.
tomjen3 10y ago
Why should we trust their list?
geofft 10y ago
You need to rely on someone who sees certs in the wild that aren't in the CT log and complains. Chrome is capable of doing that (I don't know if it actually does), as are Google's web crawlers. I don't think Mozilla has anything that does that. It is true that, provided you have a CT log, it is append-only, and data can never leave the log file. But you need to make sure the right data is in it at some point.

by xnyhps 10y ago

dspillett 10y ago

> You don't need to rely on Google ... should be on WoSign's own Certificate Transparency log which you can download Given that the behaviours being documented include falsifying data (backdating certificates to get around SHA1 retirement), I would prefer to at least use information from Google (or another third party) for the purpose of verification, rather than just relying on information sourced from WoSign/StartCom.

xnyhps 10y ago
They can't backdate their Certificate Transparency log without leaving cryptographic evidence behind. That's how CT is designed to work. Of course, simply being in the log doesn't imply the cert was issued correctly, but the logs have been posted for a couple of months now and have received a lot of scrutiny during Mozilla's investigation. But the same is true for Google's log, presence in that log is also no guarantee that it was issued correctly.

tomjen3 10y ago

Why should we trust their list?

geofft 10y ago

You need to rely on someone who sees certs in the wild that aren't in the CT log and complains. Chrome is capable of doing that (I don't know if it actually does), as are Google's web crawlers. I don't think Mozilla has anything that does that. It is true that, provided you have a CT log, it is append-only, and data can never leave the log file. But you need to make sure the right data is in it at some point.