6 ms·

Symantec caught once again improperly issuing illegitimate HTTPS certificates

114 points by ghosh 10y ago

finnn 10y ago
Source: https://www.mail-archive.com/dev-security-policy@lists.mozilla.org/msg05455.html https://www.mail-archive.com/dev-security-policy@lists.mozil...
pg_is_a_butt 10y ago
so revoke symantec. oh right, you all rally around the money and don't do shit to fix actual problems. you're all idiots.
Titanous 10y ago
Previous discussion: https://news.ycombinator.com/item?id=13449398 https://news.ycombinator.com/item?id=13449398 (edited for clarity)
- funnyfacts365 10y ago
  More recent? The current post is from 2 hours ago. The one you posted is from 2 days ago.
  - grhmc 10y ago
    Perhaps more as in "additional, recent discussion"
EdHominem 10y ago
We've got a real too-big-to-fail going on here. If a little company screwed something up this badly they'd be dead. But when one the size of Symantec screws up - oh well they've got too many customers for us to revoke their signing privileges. It's a ridiculous system and fwiw, it shouldn't be the security companies (though that's being very polite to Symantec) that grant certificates. It should be notary publics (a business all about assurance of human identity) using a physical appliance. Or, admit we don't care and ditch the entire system for something based on bailing wire and chewing gum, because that's roughly what we've got now.
- DiabloD3 10y ago
  Except if Google decided to drop their certs, what Synmantec going to do? Sue? Google could be sued for leaving known insecure certs in Chrome.
  - colechristensen 10y ago
    All google would have to do is warn that +1w all symc new certs will come with a yellow warning.
  - EdHominem 10y ago
    Symantec can threaten larger lawsuits than you can, so we know how that'd come out. Also, and most critically, it's musical chairs between cloud and security companies. If Symantec came to Google to complain it's likely they'd go straight to VPs who used to work with them and get special treatment. Hence the call to use notaries. Let's avoid the whole buddy network.
- mike-cardwell 10y ago
  "they've got too many customers for us to revoke their signing privileges" We can however ban them from issuing any new certs. It wouldn't be the first time this has been done.
  - dsp1234 10y ago
    https://blog.mozilla.org/security/2016/10/24/distrusting-new-wosign-and-startcom-certificates/ https://blog.mozilla.org/security/2016/10/24/distrusting-new...
- libertymcateer 10y ago
  > It should be notary publics (a business all about assurance of human identity) using a physical appliance. As an attorney, and notary public, I cannot begin to explain to you how grossly misguided you are. The requirements to become a notary public are extraordinarily low. The notary public exam should be passable by someone with a tenth grade education. It substantially easier to become a notary public than to get a driver's license. https://www.nationalnotary.org/new-york#NYRequirements https://www.nationalnotary.org/new-york#NYRequirements Not to mention that any attorney admitted to the NY BAR can automatically become a notary without any further testing or requirement. I think it is probably safe to say that a single digit percentage of attorneys in NY state can even articulate what an SSL cert is, much less be trusted to issue them. A very substantial portion of admitted NY attorneys are routinely bested by their own email programs for pete's sake. This idea is wholly, entirely preposterous.
poizan42 10y ago
Wouldn't a course of action be to forbid Symantec from letting their partners issue certificates using their intermediate CAs? That would probably mean that Symantec would have to pay compensation to their partners for being forced to breach their contract.
bandrami 10y ago
I sometimes wonder why we don't just skip the CA layer entirely and let the browsers be the CAs. Buy a "mozilla cert" and an "IE cert" and a "Chrome cert", and all the derivatives of them can hitch a ride based on that. It would fund browser development and eliminate the steaming pile of misplaced trust that is the PKI system. Sometime last year I deleted my CA certificates because I finally realized I'm never going to actually audit all of the certs in there, and I know there are confirmed bad actors among them, so I shouldn't give myself a false sense of security.
- 542458 10y ago
  Hm. That's an interesting idea, since browser vendors have more incentive to maintain a good brand than random CAs that most people have never heard of. My big concern is browsers effectively would have a monopoly over their users (in theory users can switch but in practice most wouldn't), meaning that browsers could dramatically overcharge for their certs. I wouldn't be worried about, say, Mozilla, but some other vendors might not play nice...
  - kardos 10y ago
    Well, also it would divide their focus between producing excellent browsers and bureaucratic certificate details. I think it would make more sense to create another non-profit variant of Let's Encrypt for EV certs.
  - bandrami 10y ago
    browsers effectively would have a monopoly over their users Sure, and there's already such a troublingly small vendor's market to begin with (Microsoft, Google, Mozilla, really). This idea would definitely have problems, but then again so does what we're doing now...
    - snovv_crash 10y ago
      And Apple, since you can't replace mobile Safari, just reskin it.
  - 10y ago
HillaryBriss 10y ago
i like the wording in Symantec's press release: "Symantec has learned of a possible situation..." so, let's not be hasty. this isn't a security problem. it's just a "possible situation". hell, we've all been in situations before. there's nothing inherently wrong with a situation, even if it took place in a location named "test, Korea". i mean, hey, we've all taken tests. some of us have even been in test situations. it's not a problem. you can just go now. this is not the situation you're looking for.
SEJeff 10y ago
When is Google / Mozilla going to just blacklist them as a CA for anything going forward? This seems like a thing where they'd be lucky to give you a single warning as this could literally get people killed due to oppressive regimes doing MiTM.
flareback 10y ago
"Symantec caught once again improperly issuing illegitimate HTTPS certificates" So I wonder what the correct way to issue illegitimate HTTPS certificates is?
axoltl 10y ago
Looks like there's more: https://crt.sh/?id=63552608 https://crt.sh/?id=63552608 with commonName: jotestintermediate.bbtest.net
- pfg 10y ago
  They seem to own the domain in question, so that could've been validated according to spec. The only thing that's weird in that certificate would be the organizationalUnitName being "Test"; I don't think that would be a Baseline Requirements violation as such. They only require that the OU field be not misleading (i.e. you can't use a trademark you do not own as your OU, etc.)

114 points by ghosh 10y ago

finnn 10y ago

Source: https://www.mail-archive.com/dev-security-policy@lists.mozilla.org/msg05455.html https://www.mail-archive.com/dev-security-policy@lists.mozil...

pg_is_a_butt 10y ago

so revoke symantec. oh right, you all rally around the money and don't do shit to fix actual problems. you're all idiots.

Titanous 10y ago

Previous discussion: https://news.ycombinator.com/item?id=13449398 https://news.ycombinator.com/item?id=13449398 (edited for clarity)

funnyfacts365 10y ago
More recent? The current post is from 2 hours ago. The one you posted is from 2 days ago.
- grhmc 10y ago
  Perhaps more as in "additional, recent discussion"

EdHominem 10y ago

We've got a real too-big-to-fail going on here. If a little company screwed something up this badly they'd be dead. But when one the size of Symantec screws up - oh well they've got too many customers for us to revoke their signing privileges. It's a ridiculous system and fwiw, it shouldn't be the security companies (though that's being very polite to Symantec) that grant certificates. It should be notary publics (a business all about assurance of human identity) using a physical appliance. Or, admit we don't care and ditch the entire system for something based on bailing wire and chewing gum, because that's roughly what we've got now.

DiabloD3 10y ago
Except if Google decided to drop their certs, what Synmantec going to do? Sue? Google could be sued for leaving known insecure certs in Chrome.
- colechristensen 10y ago
  All google would have to do is warn that +1w all symc new certs will come with a yellow warning.
- EdHominem 10y ago
  Symantec can threaten larger lawsuits than you can, so we know how that'd come out. Also, and most critically, it's musical chairs between cloud and security companies. If Symantec came to Google to complain it's likely they'd go straight to VPs who used to work with them and get special treatment. Hence the call to use notaries. Let's avoid the whole buddy network.
mike-cardwell 10y ago
"they've got too many customers for us to revoke their signing privileges" We can however ban them from issuing any new certs. It wouldn't be the first time this has been done.
- dsp1234 10y ago
  https://blog.mozilla.org/security/2016/10/24/distrusting-new-wosign-and-startcom-certificates/ https://blog.mozilla.org/security/2016/10/24/distrusting-new...
libertymcateer 10y ago
> It should be notary publics (a business all about assurance of human identity) using a physical appliance. As an attorney, and notary public, I cannot begin to explain to you how grossly misguided you are. The requirements to become a notary public are extraordinarily low. The notary public exam should be passable by someone with a tenth grade education. It substantially easier to become a notary public than to get a driver's license. https://www.nationalnotary.org/new-york#NYRequirements https://www.nationalnotary.org/new-york#NYRequirements Not to mention that any attorney admitted to the NY BAR can automatically become a notary without any further testing or requirement. I think it is probably safe to say that a single digit percentage of attorneys in NY state can even articulate what an SSL cert is, much less be trusted to issue them. A very substantial portion of admitted NY attorneys are routinely bested by their own email programs for pete's sake. This idea is wholly, entirely preposterous.

poizan42 10y ago

Wouldn't a course of action be to forbid Symantec from letting their partners issue certificates using their intermediate CAs? That would probably mean that Symantec would have to pay compensation to their partners for being forced to breach their contract.

bandrami 10y ago

I sometimes wonder why we don't just skip the CA layer entirely and let the browsers be the CAs. Buy a "mozilla cert" and an "IE cert" and a "Chrome cert", and all the derivatives of them can hitch a ride based on that. It would fund browser development and eliminate the steaming pile of misplaced trust that is the PKI system. Sometime last year I deleted my CA certificates because I finally realized I'm never going to actually audit all of the certs in there, and I know there are confirmed bad actors among them, so I shouldn't give myself a false sense of security.

542458 10y ago
Hm. That's an interesting idea, since browser vendors have more incentive to maintain a good brand than random CAs that most people have never heard of. My big concern is browsers effectively would have a monopoly over their users (in theory users can switch but in practice most wouldn't), meaning that browsers could dramatically overcharge for their certs. I wouldn't be worried about, say, Mozilla, but some other vendors might not play nice...
- kardos 10y ago
  Well, also it would divide their focus between producing excellent browsers and bureaucratic certificate details. I think it would make more sense to create another non-profit variant of Let's Encrypt for EV certs.
- bandrami 10y ago
  browsers effectively would have a monopoly over their users Sure, and there's already such a troublingly small vendor's market to begin with (Microsoft, Google, Mozilla, really). This idea would definitely have problems, but then again so does what we're doing now...
  - snovv_crash 10y ago
    And Apple, since you can't replace mobile Safari, just reskin it.
- 10y ago

HillaryBriss 10y ago

i like the wording in Symantec's press release: "Symantec has learned of a possible situation..." so, let's not be hasty. this isn't a security problem. it's just a "possible situation". hell, we've all been in situations before. there's nothing inherently wrong with a situation, even if it took place in a location named "test, Korea". i mean, hey, we've all taken tests. some of us have even been in test situations. it's not a problem. you can just go now. this is not the situation you're looking for.

SEJeff 10y ago

When is Google / Mozilla going to just blacklist them as a CA for anything going forward? This seems like a thing where they'd be lucky to give you a single warning as this could literally get people killed due to oppressive regimes doing MiTM.

flareback 10y ago

"Symantec caught once again improperly issuing illegitimate HTTPS certificates" So I wonder what the correct way to issue illegitimate HTTPS certificates is?

axoltl 10y ago

Looks like there's more: https://crt.sh/?id=63552608 https://crt.sh/?id=63552608 with commonName: jotestintermediate.bbtest.net

pfg 10y ago
They seem to own the domain in question, so that could've been validated according to spec. The only thing that's weird in that certificate would be the organizationalUnitName being "Test"; I don't think that would be a Baseline Requirements violation as such. They only require that the OU field be not misleading (i.e. you can't use a trademark you do not own as your OU, etc.)