5 ms·

I'd be interested to know what the plans are from other vendors (Microsoft, Google, Apple, ...); can we expect them to follow Mozilla's lead in taking action ag

by nandhp 10y ago

I'd be interested to know what the plans are from other vendors (Microsoft, Google, Apple, ...); can we expect them to follow Mozilla's lead in taking action against WoSign?

popey456963 10y ago
Considering I believe one of the writers of this was from Google, I guess we can assume they'll likely follow? With both Chrome and Firefox no longer allowing certificates from them we can expect customers to no longer buy from them which will result in no more certificates even if Apple/Microsoft don't follow.
- JonathonW 10y ago
  Does Chrome maintain its own trusted certificate list on any platform? IIRC, it uses the OS's trust store on Windows and macOS, and NSS (so, Mozilla's trust store) on Linux. So, it's up to Apple and Microsoft to handle this for Chrome users on those platforms.
  - pquerna 10y ago
    Yes, Chrome generally uses the OS trust store as "trust roots", however Chrome layers on additional validation and pinning in the Chrome code: CRLSets: https://dev.chromium.org/Home/chromium-security/crlsets https://dev.chromium.org/Home/chromium-security/crlsets HSTS Preloading: https://hstspreload.appspot.com/ https://hstspreload.appspot.com/ more: https://www.chromium.org/Home/chromium-security/security-faq#TOC-How-does-key-pinning-interact-with-local-proxies-and-filters- https://www.chromium.org/Home/chromium-security/security-faq...
  - pkhagah 10y ago
    Chrome uses OS CA store. But, it has 'Removal of Trust' cluase which expects CA store to follow some guidelines. Starcom might be in covered in that guideline. So, blacklisting a CA store is possible. https://www.chromium.org/Home/chromium-security/root-ca-policy https://www.chromium.org/Home/chromium-security/root-ca-poli...
jcranmer 10y ago
CA root lists are generally maintained on an OS level (Oracle does maintain a separate root list for Java). Linux doesn't really have a central CA, so in practice, the root certificate list for all of Linux usually comes from Mozilla. Mozilla's CA policy is the only major policy where almost all discussion is public (indeed, its policy requires a public commentary period), so its decision is the most visible by far. Given that the major list vendors already collaborate in the CAB forum, it's likely that MS and Apple will follow the Mozilla/Google lead here. The prior Diginotar and Comodo scenarios involved all the vendors operating in tandem.
RJIb8RBYxzAMX9u 10y ago
When the story first broke, I manually untrusted WoSign's and StartCom's root certificates in OS X, instead of deleting them outright...at least I thought I did. I upgraded to macOS 10.12 Sierra this past weekend, and repeated the process. Except WoSign's certificates aren't there to begin with, though StartCom's still are. So perhaps Apple had dropped WoSign already? Would anyone else running 10.12 verify?
- pfg 10y ago
  IIRC WoSign was never in Apple's trust store in the first place; their trust status came from StartCom cross-signing their certificates. (Not sure if cached intermediate certificates get added to the keychain - maybe that's what you saw previously?)
  - alpb 10y ago
    I can say +1. WoSign has never been in OS X trust chain as I hit this issue once before and had to install it myself manually. You can search about WoSign and OS X on Google and you will see that it was never there. If you found it in your trust store in the first place, there must be some shady business going on in your Mac. Also similar comments in this other HN thread: https://news.ycombinator.com/item?id=12389573 https://news.ycombinator.com/item?id=12389573
- an_account_name 10y ago
  I had distrusted a bunch of others, too - it looks like the update flipped everything to be trusted again. Thanks for the heads up.
- tveita 10y ago
  Possibly it is an intermediate certificate that is not cached yet. Does https://www.wosign.com/ https://www.wosign.com/ give you a certificate error, and does the certificate appear in the list after visiting the site?

by nandhp 10y ago

I'd be interested to know what the plans are from other vendors (Microsoft, Google, Apple, ...); can we expect them to follow Mozilla's lead in taking action against WoSign?

popey456963 10y ago

Considering I believe one of the writers of this was from Google, I guess we can assume they'll likely follow? With both Chrome and Firefox no longer allowing certificates from them we can expect customers to no longer buy from them which will result in no more certificates even if Apple/Microsoft don't follow.

JonathonW 10y ago
Does Chrome maintain its own trusted certificate list on any platform? IIRC, it uses the OS's trust store on Windows and macOS, and NSS (so, Mozilla's trust store) on Linux. So, it's up to Apple and Microsoft to handle this for Chrome users on those platforms.
- pquerna 10y ago
  Yes, Chrome generally uses the OS trust store as "trust roots", however Chrome layers on additional validation and pinning in the Chrome code: CRLSets: https://dev.chromium.org/Home/chromium-security/crlsets https://dev.chromium.org/Home/chromium-security/crlsets HSTS Preloading: https://hstspreload.appspot.com/ https://hstspreload.appspot.com/ more: https://www.chromium.org/Home/chromium-security/security-faq#TOC-How-does-key-pinning-interact-with-local-proxies-and-filters- https://www.chromium.org/Home/chromium-security/security-faq...
- pkhagah 10y ago
  Chrome uses OS CA store. But, it has 'Removal of Trust' cluase which expects CA store to follow some guidelines. Starcom might be in covered in that guideline. So, blacklisting a CA store is possible. https://www.chromium.org/Home/chromium-security/root-ca-policy https://www.chromium.org/Home/chromium-security/root-ca-poli...

jcranmer 10y ago

CA root lists are generally maintained on an OS level (Oracle does maintain a separate root list for Java). Linux doesn't really have a central CA, so in practice, the root certificate list for all of Linux usually comes from Mozilla. Mozilla's CA policy is the only major policy where almost all discussion is public (indeed, its policy requires a public commentary period), so its decision is the most visible by far. Given that the major list vendors already collaborate in the CAB forum, it's likely that MS and Apple will follow the Mozilla/Google lead here. The prior Diginotar and Comodo scenarios involved all the vendors operating in tandem.

RJIb8RBYxzAMX9u 10y ago

When the story first broke, I manually untrusted WoSign's and StartCom's root certificates in OS X, instead of deleting them outright...at least I thought I did. I upgraded to macOS 10.12 Sierra this past weekend, and repeated the process. Except WoSign's certificates aren't there to begin with, though StartCom's still are. So perhaps Apple had dropped WoSign already? Would anyone else running 10.12 verify?

pfg 10y ago
IIRC WoSign was never in Apple's trust store in the first place; their trust status came from StartCom cross-signing their certificates. (Not sure if cached intermediate certificates get added to the keychain - maybe that's what you saw previously?)
- alpb 10y ago
  I can say +1. WoSign has never been in OS X trust chain as I hit this issue once before and had to install it myself manually. You can search about WoSign and OS X on Google and you will see that it was never there. If you found it in your trust store in the first place, there must be some shady business going on in your Mac. Also similar comments in this other HN thread: https://news.ycombinator.com/item?id=12389573 https://news.ycombinator.com/item?id=12389573
an_account_name 10y ago
I had distrusted a bunch of others, too - it looks like the update flipped everything to be trusted again. Thanks for the heads up.
tveita 10y ago
Possibly it is an intermediate certificate that is not cached yet. Does https://www.wosign.com/ https://www.wosign.com/ give you a certificate error, and does the certificate appear in the list after visiting the site?