4 ms·
"Trustico allows customers to generate a Certificate Signing Request and Private Key during the ordering process," the statement read. "These Private Keys are s
by aiCeivi9 9y ago
"Trustico allows customers to generate a Certificate Signing Request and Private Key during the ordering process," the statement read. "These Private Keys are stored in cold storage, for the purpose of revocation."
Maybe they decided preparing CSR is too hard for their clients :/
- BuildTheRobots 9y agoLots of companies used to allow this, GlobalSign being one of the biggest that jumps to mind (iirc they stopped it in the last couple of months). The idea that the company would store the private keys, however, is even more troubling.
- u801e 9y ago> Maybe they decided preparing CSR is too hard for their clients :/ It seems that a lot of businesses and people feel that making things "easier and more convenient" takes priority over best security practices. For example, we can't support client side TLS cert authentication (in addition to a username and password) because customers won't be able to generate the CSR or know how to import the certificate into their client. Instead, let's use SMS or email based two factor authentication.
- recursive 9y agoAnd they're probably not wrong. In other words, I suspect that if there were two identical competing services, the convenient one would win. If one only supported client certs, and one only supported 2FA, I have a (unsupported) feeling that the client cert company would not survive long.
- jis 9y agoYep. The problem is that most customers cannot judge the level of security offered by a company. So Company "A" says they are "secure," but has a cumbersome process to follow to get a certificate. Company "B" says they are "secure" and has a convenient process. Guess which one gets the business (all else being equal). In reality Company "B" may well be much less secure then "A", but the customer has no way of knowing that or making a judgement on which company is more secure.
- HelloNurse 9y agoOn the other hand, a customer who doesn't realize that their private key should never leave their premises has no business asking for a certificate. It's like not selling guns to children.
- u801e 9y agoWhile that may be true, that doesn't mean the rest of us shouldn't have the option of using certificate based authentication.
- HelloNurse 9y agoWe have the option of using certificates, but not the option of giving away private keys.
- u801e 9y agoCould a company offer both options? That is, a customer could choose whether to use a client certificate or SMS message/email based 2FA.
- chedabob 9y agoI don't understand why they'd need the Private Keys for revocation. Isn't one of the reasons to revoke because you've lost the private key?
- edaemon 9y agoYou don't need the private keys for revocation, and you're right that compromise of the private key is one of the best reasons to revoke a cert. I can't figure out why the Trustico CEO emailed the private keys to DigiCert. It doesn't make sense.
- wcoenen 9y agoThe Trustico CEO intentionally compromised the private keys to force DigiCert to revoke the certificates. DigiCert wouldn't do this otherwise on his request; it's the actual owner of the certificate who needs to request revocation.
- edaemon 9y agoI meant I don't get why he would want to do that. Why insist that all of his customers' keys be revoked? Why intentionally compromise the keys to make that happen? After reading more about it, though, I think it's less that it doesn't make sense and more that the person making these decisions is incompetent.
- MertsA 9y agoIn fairness, all of those private keys were already compromised from the start. I have no clue why the CEO decided to take such harmful action to his own company, but one way or another all of those certificates needed to be reissued.