5 ms·

While I agree that they did the wrong thing and WoSign/StartCom should be punished for lying, the whole sha-1 deprecation thing is very black and white. Others

While I agree that they did the wrong thing and WoSign/StartCom should be punished for lying, the whole sha-1 deprecation thing is very black and white. Others have successfully gained "exemptions" to do precisely this, and it's an interesting question whether it would have been easy for WoSign to get those same exemptions if they'd just asked. I bet the answer is "possible but not easy". Meanwhile: http://security.stackexchange.com/questions/86609/this-is-2015-has-sha1-been-exploited-or-cracked-yet http://security.stackexchange.com/questions/86609/this-is-20... https://www.schneier.com/blog/archives/2015/10/sha-1_freestart.html https://www.schneier.com/blog/archives/2015/10/sha-1_freesta... "Freestart collisions, like the one presented here, do not directly imply a collision for SHA-1" "this work is an important milestone towards an actual SHA-1 collision" https://en.wikipedia.org/wiki/SHA-1 https://en.wikipedia.org/wiki/SHA-1 "SHA-1 is no longer considered secure against well-funded opponents". AKA, SHA-1 may not be secure against a nation state or attacker with a ton of money, but it's secure enough against for almost every site against almost every attacker. Given the reported 5%+ of Chinese browsers not supporting newer certs, I can see why customers might want a cert that gives them a lot more than nothing, though less than best-of-breed. It's the one-size-fits-all where someone's personal blog needs to have the same level of security as the apple app store's payment system that leaves them filling a real market need. They didn't go seeking people wanting SHA1 certs, people wanting SHA1 certs that would still work went seeking someone who would provide them. And they went seeking because the alternative is upgrading potentially millions of dollars worth of embedded kit which doesn't support newer certs, all to secure one link in a chain in which SHA1 is nowhere near the weakest link. So yeah, the CAB chose to inflict a ton of pain and cause still-functioning hardware to be discarded in order to push a more secure ecosystem on everybody. Which is great from some perspectives, but it's environmental vandalism from another perspective, and if it pushes people back to non-HTTPS traffic for those older pieces of equipment it could cause a short term worsening of security. (the deprecation of sha1 that is. The lying by WoSign/StartCom was a calculated risk in a business where everything is based on trust, and they lost)

takluyver 10y ago
> I bet the answer is "possible but not easy". I would bet the same. This seems like what you want for an exemption process: if it's too easy, people will use exemptions rather than fixing an underlying problem. > someone's personal blog needs to have the same level of security as the apple app store's payment system Different grades of security would not have helped in this case, because it was payment systems having trouble updating, and we put anything involving money on a high security tier - except when legacy systems get an exception. It's not quite one-size-fits-all, because EV certificates are meant to show more trust, and most banks etc. will use those. That takes extra work, which isn't worth it for a personal site. But you don't save any work by using a weaker hash algorithm, so there's no reason for a personal blog to do so. > the CAB chose to inflict a ton of pain and cause still-functioning hardware to be discarded It does sound like they should have had an exemption process set up before the cutoff date, or put the cutoff further out to give people more time to upgrade systems. But using Hanlon's razor, it was probably an oversight rather than deliberate 'environmental vandalism'.
xnyhps 10y ago
> AKA, SHA-1 may not be secure against a nation state or attacker with a ton of money, but it's secure enough against for almost every site against almost every attacker. Issuing a SHA-1 certificate for one domain doesn't just put that domain at risk, it threatens the entire ecosystem. Someone requesting such a cert may have a second cert with the same hash, but for a different domain or even an intermediate, like the MD5 collision. It's not like you could avoid this by asking "are you a nation state attacker" during the application process.

takluyver 10y ago

> I bet the answer is "possible but not easy". I would bet the same. This seems like what you want for an exemption process: if it's too easy, people will use exemptions rather than fixing an underlying problem. > someone's personal blog needs to have the same level of security as the apple app store's payment system Different grades of security would not have helped in this case, because it was payment systems having trouble updating, and we put anything involving money on a high security tier - except when legacy systems get an exception. It's not quite one-size-fits-all, because EV certificates are meant to show more trust, and most banks etc. will use those. That takes extra work, which isn't worth it for a personal site. But you don't save any work by using a weaker hash algorithm, so there's no reason for a personal blog to do so. > the CAB chose to inflict a ton of pain and cause still-functioning hardware to be discarded It does sound like they should have had an exemption process set up before the cutoff date, or put the cutoff further out to give people more time to upgrade systems. But using Hanlon's razor, it was probably an oversight rather than deliberate 'environmental vandalism'.

xnyhps 10y ago

> AKA, SHA-1 may not be secure against a nation state or attacker with a ton of money, but it's secure enough against for almost every site against almost every attacker. Issuing a SHA-1 certificate for one domain doesn't just put that domain at risk, it threatens the entire ecosystem. Someone requesting such a cert may have a second cert with the same hash, but for a different domain or even an intermediate, like the MD5 collision. It's not like you could avoid this by asking "are you a nation state attacker" during the application process.