8 ms·
WoSign and letsencrypt.cn
- ryanlol 10y agoIt's really difficult to understand why anyone would want to do this. Unless they were working with Let's Encrypt directly I really don't see how this could ever be acceptable. Why would anyone do such an obviously bad thing and slap their company information in the whois?
- guitarbill 10y agoBecause they thought they could get away with it - just like all of the other stuff they've done. And they did get away with it for a while.
- ryanlol 10y agoWhat's the motivation though? It doesn't seem like they've really ever used the domain. Right now this all just seems utterly pointless and stupid on their part, but I guess that's really nothing new.
- avian 10y agoTo me, the most obvious motivation for registering the domain would be to basically make a domain squat. Redirect anyone visiting "letsencrypt.cn" to their own, similarly named (and now defunct as far as I know) service "StartEncrypt" [1]. Like any other domain squat, it would probably allow them to profit to some degree from the buzz Let's Encrypt was generating. [1] https://news.ycombinator.com/item?id=11903513 https://news.ycombinator.com/item?id=11903513
- vertex-four 10y agoExcept that they weren't doing that.
- rhizome 10y agoA "win at all costs" mentality, "winning" being defined as "whatever I feel like doing." You see a lot of this trait in the criminal justice system, if you've never been through it.
- tptacek 10y agoFor anyone who doesn't know the backstory on this already: WoSign (and, after WoSign quietly acquired it, StartCom) were distrusted by Mozilla for mismanagement ranging from backdating certificate to bypass crypto requirements to accidentally mis-issuing certificates. It is unlikely that WoSign or any CA run by WoSign will ever fully compatible with browsers in the future.
- JumpCrisscross 10y agoAre they distrusted by iOS and macOS?
- tptacek 10y agohttps://support.apple.com/en-us/HT204132 https://support.apple.com/en-us/HT204132 In the long run: indefinite (likely permanent) distrust by Mozilla is probably the death sentence for any CA.
- dantiberian 10y agoIt looks like WoSign is already back at it, reselling certs from another CA. I understand someone else is doing the issuing, but I'd hoped that they would die a quick death, not hang on bitterly: https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/YAZAr1UXjl8 https://groups.google.com/forum/#!topic/mozilla.dev.security...
- mijoharas 10y agoHas anyone else noticed that Richard Wang has replied on both this linked to thread, and the parent thread now. I thought I had read that he had stepped down as the WoSign CEO?
- hackerboos 10y agoStartcom's certs still show as ok in Firefox for me. Any idea when this kicks in?
- koolba 10y agoFor those of you who don't read beyond the subject line, here's the meat: > It seams that wosign has registered the domains letsencrypt.cn and letsencrypt.com.cn in 2014 after the public announce of Let's Encrypt. And here's the whois record: $ whois letsencrypt.cn Domain Name: letsencrypt.cn ROID: 20141120s10001s72911711-cn Domain Status: clientTransferProhibited Registrant ID: k35-n2041486_00 Registrant: 深圳市沃通电子商务服务有限公司 Registrant Contact Email: dns@wosign.com Sponsoring Registrar: 厦门三五互联科技股份有限公司 Name Server: ns3.dns-diy.com Name Server: ns4.dns-diy.com Registration Time: 2014-11-20 09:57:27 Expiration Time: 2017-11-20 09:57:27 DNSSEC: unsigned Unless they registered those domains to "reserve" them for LetsEncrypt (haha right?), this is pretty blatantly deceptive, or at least they planned to be. Then again not exactly the worst thing they've done in the world of SSL.
- walrus01 10y agoThis is so blatantly abusive that wosign and startcom needs to be pulled from all trusted root CA stores immediately. If their SSL cert clients' websites break, so be it. This is outright malicious behavior. The internet engineering community would come down like a ton of bricks if somebody registered ripe.cn and decided to impersonate RIPE. Same principle.
- Hondor 10y agoThey didn't impersonate letsencrypt so that doesn't apply.
- arthur2e5 10y agoIt's true that they didn't impersonate letsencrypt, but they did: 1. Assign DNS records to these two domains and remove them after someone exposed these domains. https://groups.google.com/d/msg/mozilla.dev.security.policy/E13eT13wMBQ/jNTh-5K1CQAJ; https://groups.google.com/d/msg/mozilla.dev.security.policy/... https://archive.fo/MQwMK; https://archive.fo/MQwMK; https://archive.fo/0HQZ7 https://archive.fo/0HQZ7 2. Send marketing e-mails that exaggerate threats of using a "foreign CA", such as Let's Encrypt: https://groups.google.com/d/msg/mozilla.dev.security.policy/E13eT13wMBQ/Cky6aXbZCQAJ https://groups.google.com/d/msg/mozilla.dev.security.policy/... (Well, "Percy" has always been bringing it up.) While (2) has been something too old to keep bringing up, (1) certainly undermines some of Richard Wang's claim.
- skrowl 10y agoA similar name may be enough to fool everyday users, but I don't think they're going to trick Mozilla and Google into trusting then.
- SallySwanSmith 10y agoWhy would that matter? They can set up a similar service and use the wosign ca and Mozilla/google wouldn't know anything is amiss
- praseodym 10y agoThey are already distrusted: https://news.ycombinator.com/item?id=12787029 https://news.ycombinator.com/item?id=12787029
- steventhedev 10y agoPrevious discussion: https://news.ycombinator.com/item?id=12582534 https://news.ycombinator.com/item?id=12582534 tl;dr - WoSign/StartCom are no longer trusted as a CA (at least by Firefox)
- svenfaw 10y agoHowever, previously issued certs are still trusted. For instance, Firefox doesn't complain about this site's WoSign cert: https://www.checkmyping.com/ https://www.checkmyping.com/
- tscs37 10y agoExisting certs are still trusted. Mozilla stated that they will not distrust certs issued with notBefore till December, so theoretically this cert is good for as long as it's still valid, only after that they need to worry.
- beatle_sauce 10y agoThis could develop further. Reminds me of TOM Skype: Chinese users are redirected from skype.com to the chinese-characteristics website skype.tom.com which serves a censorship-enabled version of skype, see https://en.greatfire.org/blog/2013/nov/tom-skype-dead-long-live-microsoft-surveillance https://en.greatfire.org/blog/2013/nov/tom-skype-dead-long-l...
- yadongwen 10y agoWell this is a collaboration b/t Skype and TOM.com. Skype has to do it b/c they don't have license to operate in China. My skype account was registered in China and I have to prove I'm not in China anymore to remove the association..
- inimino 10y agoSkype chooses to do it. They could also simply choose not to cooperate, and be blocked.
- artursapek 10y agoBusiness as usual in the dirty cert industry https://letsencrypt.org/2016/06/23/defending-our-brand.html https://letsencrypt.org/2016/06/23/defending-our-brand.html
- ns8sl 10y agoThe Twit network has some very detailed podcasts about Wosign's sliminess: https://twit.tv/search/wosign https://twit.tv/search/wosign This is a CA death penalty situation as far as I'm concerned.
- wjossey 10y ago+1 wrt to the twit conversations. Leo & Steve Gibson on Security Now have regularly spoken about wosign, and it's the primary reason why my antenna immediately perked up when I saw the headline. As a general note, the content on the TWiT network is superb. I love the great ethics conversations that are had on TWiG (This Week in Google). I've loved listening to the "coming out of the wilderness" progression of Mary Jo Foley & Paul Thurrott with regards to Microsoft on Windows Weekly. And Security Now is my guilty educational pleasure, as its greatly expanded my knowledge of security issues and topics, which have served me well over the past few years.
- ns8sl 10y agoSteve Gibson will go into levels of detail that amaze me. The podcast on Rowhammer is a perfect example - down to the minute details of how VMs store memory pages... Its also can be a great sleep aid.
- 616c 10y agoCrap, I am not even familiar with that episode, and SN is the longest running on TWiT. Link? Is 498 or 576? https://twit.tv/shows/security-now/episodes/498 https://twit.tv/shows/security-now/episodes/498 https://twit.tv/shows/security-now/episodes/576 https://twit.tv/shows/security-now/episodes/576
- ns8sl 10y agohttps://twit.tv/shows/security-now/episodes/576 https://twit.tv/shows/security-now/episodes/576
- deleted 10y ago[deleted]
- EGreg 10y agoDo we have to run certbot every few months to update the certs? Can we set up a cron to do it? Thoughts welcome.
- elliottcarlson 10y agoYes - you can add it to a cronjob, as well as add a `--renew-hook` option that tells it to do something post renewal, such as restart your webserver. See https://certbot.eff.org/docs/using.html#renewing-certificates https://certbot.eff.org/docs/using.html#renewing-certificate...
- ranger207 10y agoI've been using certbot to automatically update my cert for about a year now with cron. It automatically checks the cert's expiration date and starts trying to renew a couple of weeks before it runs out, and for nginx at least you don't even have to reload.
- vertex-four 10y agoThe documentation recommends using a cron job[0] - the renew subcommand will renew all certificates you have in plenty of time automatically. Set it to run once a week or so, and it'll figure out what to renew and when. [0] https://certbot.eff.org/docs/using.html#renewing-certificates https://certbot.eff.org/docs/using.html#renewing-certificate...
- gravyboat 10y agoI just use a cron: /path/to/letsencrypt/letsencrypt-auto -d domain.con certonly && service nginx reload
- Buge 10y agoI don't see how it's a security problem. Just because the domains are similar doesn't mean browsers will accidentally start trusting the CA.
- Sanddancer 10y agoThis is how these sort of attacks have always worked. Get something that's just close enough so that it passes the glance attack. If someone doesn't notice anything in the first few seconds, you've done half your work right there.
- Buge 10y agoWhat is going to happen in a quick glance? Including a CA in a browser is an extremely long and drawn out processing involving third party audits and many other things costing hundreds of thousands of dollars. There is zero chance that no one along that whole process will notice that the TLD is actually .cn .
- inimino 10y agoObviously, but that's not the concern. The concern is that someone would visit letsencrypt.cn and end up getting a certificate from a provider that is not Let's Encrypt without really understanding that. Imagine a busy, non-SSL-expert user who just hears "Let's Encrypt is good, you should use it". Since the domains aren't being used, we can't say what the intention was, but it's being judged as part of a pattern of behavior by Wosign.
- Buge 10y agoOk, but that's not really a security problem. You don't give out your private key when getting a certificate.
- inimino 10y agoActually many customers let the CA generate the private key and copy it onto their servers, but that's not the point. It's a trust problem because of the pattern of this particular CA. Whether you call that a security problem or not is semantics. If not for the existing pattern of behavior, people would be a little more willing to look charitably on this as an honest mistake or trying to help, but given the history the assumption of good faith has been considerably weakened.
- mijoharas 10y agoHas Richard Wang left WoSign as CEO or not?
- inimino 10y agoDuring last-chance negotiations with Mozilla, they claimed he was stepping down immediately. However, Mozilla moved against them anyway, so presumably they immediately went back on that pledge once it became clear that it wasn't helping. Apart from the time of the negotiations, there haven't been any other claims that he had stepped down as far as I know.
- phonon 10y agohttps://groups.google.com/d/msg/mozilla.dev.security.policy/lWJ1zdUJPLI/ZMy-UE-yCAAJ https://groups.google.com/d/msg/mozilla.dev.security.policy/...
- novaleaf 10y agofyi, it looks like this may be overblown. Richard Wang, the person who registered the .cn domains, posted this in the thread: --------------------------- I wish everyone can talk about this case friendly and equally. It is very common that everyone can register any domain based on the first come and first service rule. We know Let's Encrypt is released after the public announcement, but two day later, its .cn domain is still not registered, I think maybe it is caused by the strict registration rule in China, so I registered it for protection that not registered by Cornbug. We don’t use those domains for any WoSign's services that we provide similar service: https://pki.click/index_En.htm https://pki.click/index_En.htm (SSL Wizard, StartEncrypt) Now, if Mozilla or Let’s Encrypt contact me officially and request to transfer the two domains to them, no any problem, we can transfer to them for FREE! But please notice that this arrangement is for friendship, not for others ...... Best Regards, Richard
- wereHamster 10y agoIf he registered the domains to 'protect' them he should have contacted LE immediately afterwards to arrange the transfer. Not wait until the world finds out. It's easy to use that form of reasoning ("I only did it for protection") after others find out. But is such a person trustworthy? I have my doubts.
- inimino 10y agoIn case anyone is wondering, "Cornbug" is a direct translation of 玉米虫 which in Chinese has the meaning of "domain squatter" in addition to the literal meaning.
- methou 10y agoAs a frequent user of the Chinternet, a .cn counterpart of a famous project is an alarm sign of non-affiliated copy of the original project or simply just someone wants to build a Chinese version (still not affiliated) community for that project. After all these dramas with .cn, a wary user should reject .cn on the first sight. Too sad for Chinese/Non-technical users, as they have no choice. There's nothing can be done about the situation.