5 ms·

This was very irresponsible from the CEO, but should not have been possible at all. The private key should be generated where it's used, a certificate signing

by dancek 9y ago

This was very irresponsible from the CEO, but should not have been possible at all. The private key should be generated where it's used, a certificate signing request created and sent to a certificate authority. After the CA makes sure the CSR is legit, they can sign the certificate without seeing the private key. Copying the private key outside the server is an unnecessary risk. Giving it to a third party such as a CA or allowing them to generate it, moreso.

sp332 9y ago
Speaking of things that shouldn't be possible: arbitrary code execution as root https://twitter.com/svblxyz/status/969220402768736258 https://twitter.com/svblxyz/status/969220402768736258 Looks like the whole site is now offline.
SEJeff 9y ago
Having the private key on a server for a certificate authority in 2018 is an unnecessary risk. They should have had a hardware security module where the private key can not be extracted out. When you can buy one relatively cheaply even from yubico, there is simply no excuse to not using one as a CA. https://www.yubico.com/products/yubihsm/ https://www.yubico.com/products/yubihsm/ All of their certs should be revoked and they should go out of business for technical incompetence plain and simple.
- verytrivial 9y ago
  Forgive my ignorance, but how does a device capable of storing something like 127 keys help a CA whom should have been storing zero client keys? Do you mean for their own keys?
  - SEJeff 9y ago
    TL;DNR: I'm an idiot and misread the story thinking the executive sent the ca private key, not the client keys This is even more egregious. Thanks for the cluebat hit to the face!
cjalmeida 9y ago
They said in the article they kept the private key to simplify the revokation process. Thus, very likely they also generated the private key. It's a bad practice promoted by issuers that want to sell a "managed" or "value added" service corporate IT is so fond of. The lesson here is that there's a lot of IT people that don't grasp the basics of key management.
- gesman 9y ago
  The road to security hell is paved with intentions to simplify.
  - cratermoon 9y ago
    That's the most succinct phrasing of the problem of security vs. users (and customers) complaining about what they perceive as the inconvenience and complexity that accompany securing digital assets.
    - creeble 9y ago
      I like to say (and it's not original) that security and convenience are two endpoints of one continuum. You can't get more of one without moving away from the other. There are a few rare near-freebies, but they always have a gotcha. And you'd better understand what they are before taking advantage of them.
  - SubiculumCode 9y ago
    The road to usability hell is paved with intentions to securify.
- 1001101 9y ago
  Why did they need customer private keys for revocation? That didn't make sense to me. [edit: thanks, cjalmeida]
  - cjalmeida 9y ago
    You need private key for the certificate management protocol. Maybe the had some arrangements for automatic revocation back when Symantec was running the CA. Anyway, you are compromising security over convenience. A trade-off IT should never accept.

by dancek 9y ago

sp332 9y ago

Speaking of things that shouldn't be possible: arbitrary code execution as root https://twitter.com/svblxyz/status/969220402768736258 https://twitter.com/svblxyz/status/969220402768736258 Looks like the whole site is now offline.

SEJeff 9y ago

Having the private key on a server for a certificate authority in 2018 is an unnecessary risk. They should have had a hardware security module where the private key can not be extracted out. When you can buy one relatively cheaply even from yubico, there is simply no excuse to not using one as a CA. https://www.yubico.com/products/yubihsm/ https://www.yubico.com/products/yubihsm/ All of their certs should be revoked and they should go out of business for technical incompetence plain and simple.

verytrivial 9y ago
Forgive my ignorance, but how does a device capable of storing something like 127 keys help a CA whom should have been storing zero client keys? Do you mean for their own keys?
- SEJeff 9y ago
  TL;DNR: I'm an idiot and misread the story thinking the executive sent the ca private key, not the client keys This is even more egregious. Thanks for the cluebat hit to the face!

cjalmeida 9y ago

They said in the article they kept the private key to simplify the revokation process. Thus, very likely they also generated the private key. It's a bad practice promoted by issuers that want to sell a "managed" or "value added" service corporate IT is so fond of. The lesson here is that there's a lot of IT people that don't grasp the basics of key management.

gesman 9y ago
The road to security hell is paved with intentions to simplify.
- cratermoon 9y ago
  That's the most succinct phrasing of the problem of security vs. users (and customers) complaining about what they perceive as the inconvenience and complexity that accompany securing digital assets.
  - creeble 9y ago
    I like to say (and it's not original) that security and convenience are two endpoints of one continuum. You can't get more of one without moving away from the other. There are a few rare near-freebies, but they always have a gotcha. And you'd better understand what they are before taking advantage of them.
- SubiculumCode 9y ago
  The road to usability hell is paved with intentions to securify.
1001101 9y ago
Why did they need customer private keys for revocation? That didn't make sense to me. [edit: thanks, cjalmeida]
- cjalmeida 9y ago
  You need private key for the certificate management protocol. Maybe the had some arrangements for automatic revocation back when Symantec was running the CA. Anyway, you are compromising security over convenience. A trade-off IT should never accept.