7 ms·

> worst case Can you develop please? To me it seems that the worst case would be an immediate and permanent revocation of their certs because of fraud. I find

by tajen 10y ago

> worst case Can you develop please? To me it seems that the worst case would be an immediate and permanent revocation of their certs because of fraud. I find Mozilla/Google very lenient in this affair, and that's probably because I don't understand what's the problem with revoking a CA with short notice. Ok it's annoying for customers, but they just have to subscribe to a new CA and install the new cert. It's annoying but it's a security emergency. If your bank was physically guarded by a security company who has been found to replace agents with puppets in 62 Macau banks, wouldn't the head of security interrupt their week-end to guard the bank and contract a new company? If CA revocation takes customers by surprise today, it's time to start revoking certs more regularly. Heck, if you don't answer to a request from your domain provider within 15 days, your domain can even be revoked. CAs are more important than that.

tptacek 10y ago
Immediate distrust of all StartCom certificates might be the worst case for WoSign/StartCom, but it's not the worst case for the incumbent CAs as a whole, and it's only marginally worse than what's being done already for WoSign/StartCom. The fact that they have a way to punish the CA business itself without punishing its customers is a good thing. It sends a clear message that the browsers can't be blackmailed out of punishing abuse by a CA's huge customer base. The browsers have demonstrated that they can put a CA basically out of business without impacting its customers. If I ran a CA, I'd be much more nervous about this than I would be about them zapping the CA and all its customers.
- JoshTriplett 10y ago
  > If I ran a CA, I'd be much more nervous about this than I would be about them zapping the CA and all its customers. Exactly. If they insta-revoked the whole CA, it'd hurt a pile of customers (many of which might decide that HTTPS isn't worth the hassle for them). And bigger CAs would say "eh, they can't do that to us, they'd break half the web". Showing that they're willing to say "no new certs from this CA" means they can use that sanction against any arbitrarily large and popular CA.
- mkj 10y ago
  So wosign's best bet might be to call Mozilla's bluff and issue backdated certs now?
  - karlshea 10y ago
    They bring that up in the document: > It is true that this date is chosen by the CA and therefore WoSign/StartCom could back-date certificates to get around this restriction. And there is, as we have explained, evidence that they have done this in the past. However, many eyes are on the Web PKI and if such additional back-dating is discovered (by any means), Mozilla will immediately and permanently revoke trust in all WoSign and StartCom roots.
    - rspeer 10y ago
      Which means it's important that they try really hard to avoid being detected. They probably can't do it, but it's still got a better chance of success for them than staying in business for a year with no sales. ---- Edit: When I think a moment more about it, my point is silly. I realize how inconceivably impossible it is for them to avoid detection. If they sell backdated certs, one easy way to detect this would be to buy one.
- caf 10y ago
  Doesn't the CA have one move left in this game of brinkmanship? They can start brazenly backdating their new certificates to fall into the accepted window, which would leave us right back at holding their own customer base hostage.
  - ge0rg 10y ago
    This is addressed in the document as well: WoSign/StartCom could back-date certificates to get around this restriction. And there is, as we have explained, evidence that they have done this in the past. However, many eyes are on the Web PKI and if such additional back-dating is discovered (by any means), Mozilla will immediately and permanently revoke trust in all WoSign and StartCom roots. If the CA really goes that route, it will be clear malicious behavior and therefore a good reason to permanently ban the CA.
    - luminiferous 10y ago
      Right, and that's fine and good for WoSign/StartCom. But what if they handed out a one year restriction to a much larger CA like Comodo, or Symantec? And that CA decided to back-date their certificates? Then we still have the problem of large CAs being able to effectively ignore these restrictions because of their large userbase. As long as such CAs are able to set the notbefore arbitrarily, they can backdate as much as they'd like. The only solution I can think of is to have some kind of giant database of all certificates seen in the wild that were issued by said CA, and not trust any new ones. (This may be something that can be done with Certificate Transparency, but I haven't read enough on that to be sure.) This would allow Mozilla/Apple/Microsoft to actually block new certificates.
- gaia 10y ago
  One more point for letsencrypt's certs short cert validity model.
seszett 10y ago
> it's annoying for customers, but they just have to subscribe to a new CA and install the new cert Well I would be a little more embarrassed than that, because Wosign/Starcom were the only ones offering free SSL certificates for international domain names. So there's no way I would pay for SSL certificates for my various personal projects and websites, but then I just couldn't get valid certificates for them anymore. Let's Encrypt might start offering them in the future, but nothing's official yet.
- talideon 10y ago
  There is: the ETA for that is the end of November. See here: https://letsencrypt.org/upcoming-features/ https://letsencrypt.org/upcoming-features/
msbarnett 10y ago
Really, either way, this is a death sentence for Wosign/Startcom. They're unlikely to survive for a year + all of the time and cost it would take to recertify without any revenue from certificate issuance. Insta-revocation therefore wouldn't really make this notably more painful for them -- they're walking dead at this point either way and there's a good chance they may even close shop before the deadline. All it would do is immediately put a bunch of their innocent customers in immediate pain, for essentially no gain. It might also send the message to, say, Symantec, that they can get away with anything, because no browser would risk revoking 30+% of the web instantly. Establishing a procedure that allows for executing a CA of any size puts everyone on notice.
- tptacek 10y ago
  It's worse even than that, because a substantial portion of their customer base will need to renew during the year, and will switch to new CAs. Not only do they forgo a year of revenue, but they also begin the next year with a substantially reduced customer base.
  - 0x0 10y ago
    Is that why they apparently have started handing out free 3 year certificates?
  - dankohn1 10y ago
    I really appreciate the analysis. However, can WoSign resell a different CA's services for the next year without their customers noticing?
    - pas 10y ago
      Sure, why not. A lot of "CAs" do this.
- mtgx 10y ago
  > They're unlikely to survive for a year Well, they might, unless the other browser vendors do the same. Firefox is only like 10% of the total browser market (mobile included).

by tajen 10y ago

tptacek 10y ago

Immediate distrust of all StartCom certificates might be the worst case for WoSign/StartCom, but it's not the worst case for the incumbent CAs as a whole, and it's only marginally worse than what's being done already for WoSign/StartCom. The fact that they have a way to punish the CA business itself without punishing its customers is a good thing. It sends a clear message that the browsers can't be blackmailed out of punishing abuse by a CA's huge customer base. The browsers have demonstrated that they can put a CA basically out of business without impacting its customers. If I ran a CA, I'd be much more nervous about this than I would be about them zapping the CA and all its customers.

JoshTriplett 10y ago
> If I ran a CA, I'd be much more nervous about this than I would be about them zapping the CA and all its customers. Exactly. If they insta-revoked the whole CA, it'd hurt a pile of customers (many of which might decide that HTTPS isn't worth the hassle for them). And bigger CAs would say "eh, they can't do that to us, they'd break half the web". Showing that they're willing to say "no new certs from this CA" means they can use that sanction against any arbitrarily large and popular CA.
mkj 10y ago
So wosign's best bet might be to call Mozilla's bluff and issue backdated certs now?
- karlshea 10y ago
  They bring that up in the document: > It is true that this date is chosen by the CA and therefore WoSign/StartCom could back-date certificates to get around this restriction. And there is, as we have explained, evidence that they have done this in the past. However, many eyes are on the Web PKI and if such additional back-dating is discovered (by any means), Mozilla will immediately and permanently revoke trust in all WoSign and StartCom roots.
  - rspeer 10y ago
    Which means it's important that they try really hard to avoid being detected. They probably can't do it, but it's still got a better chance of success for them than staying in business for a year with no sales. ---- Edit: When I think a moment more about it, my point is silly. I realize how inconceivably impossible it is for them to avoid detection. If they sell backdated certs, one easy way to detect this would be to buy one.
caf 10y ago
Doesn't the CA have one move left in this game of brinkmanship? They can start brazenly backdating their new certificates to fall into the accepted window, which would leave us right back at holding their own customer base hostage.
- ge0rg 10y ago
  This is addressed in the document as well: WoSign/StartCom could back-date certificates to get around this restriction. And there is, as we have explained, evidence that they have done this in the past. However, many eyes are on the Web PKI and if such additional back-dating is discovered (by any means), Mozilla will immediately and permanently revoke trust in all WoSign and StartCom roots. If the CA really goes that route, it will be clear malicious behavior and therefore a good reason to permanently ban the CA.
  - luminiferous 10y ago
    Right, and that's fine and good for WoSign/StartCom. But what if they handed out a one year restriction to a much larger CA like Comodo, or Symantec? And that CA decided to back-date their certificates? Then we still have the problem of large CAs being able to effectively ignore these restrictions because of their large userbase. As long as such CAs are able to set the notbefore arbitrarily, they can backdate as much as they'd like. The only solution I can think of is to have some kind of giant database of all certificates seen in the wild that were issued by said CA, and not trust any new ones. (This may be something that can be done with Certificate Transparency, but I haven't read enough on that to be sure.) This would allow Mozilla/Apple/Microsoft to actually block new certificates.
gaia 10y ago
One more point for letsencrypt's certs short cert validity model.

seszett 10y ago

> it's annoying for customers, but they just have to subscribe to a new CA and install the new cert Well I would be a little more embarrassed than that, because Wosign/Starcom were the only ones offering free SSL certificates for international domain names. So there's no way I would pay for SSL certificates for my various personal projects and websites, but then I just couldn't get valid certificates for them anymore. Let's Encrypt might start offering them in the future, but nothing's official yet.

talideon 10y ago
There is: the ETA for that is the end of November. See here: https://letsencrypt.org/upcoming-features/ https://letsencrypt.org/upcoming-features/

msbarnett 10y ago

Really, either way, this is a death sentence for Wosign/Startcom. They're unlikely to survive for a year + all of the time and cost it would take to recertify without any revenue from certificate issuance. Insta-revocation therefore wouldn't really make this notably more painful for them -- they're walking dead at this point either way and there's a good chance they may even close shop before the deadline. All it would do is immediately put a bunch of their innocent customers in immediate pain, for essentially no gain. It might also send the message to, say, Symantec, that they can get away with anything, because no browser would risk revoking 30+% of the web instantly. Establishing a procedure that allows for executing a CA of any size puts everyone on notice.

tptacek 10y ago
It's worse even than that, because a substantial portion of their customer base will need to renew during the year, and will switch to new CAs. Not only do they forgo a year of revenue, but they also begin the next year with a substantially reduced customer base.
- 0x0 10y ago
  Is that why they apparently have started handing out free 3 year certificates?
- dankohn1 10y ago
  I really appreciate the analysis. However, can WoSign resell a different CA's services for the next year without their customers noticing?
  - pas 10y ago
    Sure, why not. A lot of "CAs" do this.
mtgx 10y ago
> They're unlikely to survive for a year Well, they might, unless the other browser vendors do the same. Firefox is only like 10% of the total browser market (mobile included).