12 ms·

Tell HN: Sci-Hub's TLS certificate has started failing

244 points by AlbertoGP 8y ago

Sci-Hub started failing earlier today with a SEC_ERROR_REVOKED_CERTIFICATE error, which affects all alternative Web addresses. Don't know about .onion. Is this some kind of planned maintenance, or a sign of further trouble?

06983234 8y ago
This is exactly what I said would happen when Google started making all of us use HTTPS.
- detaro 8y ago
  What is "this"?
  - 06983234 8y ago
    Being wiped from the internet by a disagreeable CA authority. If that is what "this" is.
    - middleclick 8y ago
      FWIW, onion addresses don't require a cert, they are end-to-end encrypted by design.
      - mynameisvlad 8y ago
        Technically, nothing requires a cert. It's just best practice to have one.
    - matthewmacleod 8y ago
      That is not what "this" is.
      - codedokode 8y ago
        The grandparent comment is right. I am not going to mess with default browser settings, and almost nobody is.
    - MikkoFinell 8y ago
      http://sci-hub.tw/ http://sci-hub.tw/ is reachable no problem. Cut down on the hyperbole please.
  - AnIdiotOnTheNet 8y ago
    Likely they mean censorship via certificate revocation, which it isn't clear yet that this is, but they have a valid point. If you put control over your trust in a third party, you give them the power to do this kind of thing.
    - tscs37 8y ago
      You can always manually trust certificates via various means, it's the basis for almost any corporate network, most browsers also offer a simply dialog to bypass certificate warnings.
      - detaro 8y ago
        You can also just use HTTP, since sci-hub doesn't force HTTPS.
      - 0x00000000 8y ago
        Browsers seem to be moving towards making it harder to bypass, which is probably a good thing for the average user. I wouldn't be surprised to see the ability to ignore https errors (or access http sites at all) locked behind a developer setting or something.
        tscs37 8y ago
        On Chrome I can see that but I doubt Firefox would make that move. Plus, they won't remove the functionality to manually trust a cert (Business Users would complain).
        Sir_Substance 8y ago
        > On Chrome I can see that but I doubt Firefox would make that move. Firefox has implemented the same rules around .dev tld's as google. I use vivaldi when accessing internal company .dev domains because firefox won't let me tell it to accept the self-signed certificate.
- googledystopia 8y ago
  Oh, look. Google as the absolute arbiter of information. Who could've ever predicted that they'd start using their position for evil?
  - detaro 8y ago
    How exactly do you see Google doing anything here, outside of a general "they encourage HTTPS" (but the site still works fine over HTTP)?
- userbinator 8y ago
  You're not the only one. I hypothesised about this before in previous SciHub discussions, and SciHub isn't the only site that is/will be affected. Security is the ostensible benefit, and it's the one they advertise the most; easier censorship and centralised access control is the other---something which a lot of the pro-(traditional)-HTTPS advocates don't advertise. Make HTTPS mandatory (so no more HTTP), make it near impossible to bypass in browsers, and you have created a very effective censorship system controlled by the CAs and whatever interests they serve. Slowly ostracising and forcing "compliance" of those who don't toe the line is easier than before. They want you to be obedient sheep, living in an illusion of security and safety while continuing to mindlessly consume under their control. I will resist the urge to post that memorable Franklin quote.
  - x0x0 8y ago
    Let's not pretend the real reason google isn't so gung-ho about https everywhere is to prevent the ISPs from muscling into their businesses: * ads on page * seeing all internet traffic to enhance targeting
    - dagenix 8y ago
      You make it sound like this is a bad thing. Regardless of if it also benefits Google's business model, both of these things benefit users and website owners. The only thing that benefits from injecting ads into a page or deeper ISP tracking is some ISP executive's bonus.
      - dagenix 8y ago
        Challenge: Next person that downvotes me, also leave a comment explaining why.
  - saagarjha 8y ago
    But then you have the other issue of your ISP having the ability to meddle with what it's sending you and silently injecting or removing content from the page. Really, I don't see a great solution either way.
agumonkey 8y ago
It probably depends on what domain youre using.
- AlbertoGP 8y ago
  This seems to affect all their domain variants, but it still works without encryption: http://sci-hub.tw http://sci-hub.tw Edit: already noted by detaro https://news.ycombinator.com/item?id=16952051 https://news.ycombinator.com/item?id=16952051
  - ItsMe000001 8y ago
    I just tried https://sci-hub.tw/ https://sci-hub.tw/ (Chrome) and got a secure connection without warnings. Since the issuer of the certificate that my browser showed for the connection is "Comodo" I guess the revocation didn't reach my browser yet? EDIT: IE and Firefox say "insecure". What really annoys me: There does not seem to be any way - none that I could find - to get IE and Firefox to connect anyway?
    - a_bonobo 8y ago
      On sci-hub.hk I get a non-SSL connection, if I try the 'trick' of http://journal_name.springer.com.sci-hub.hk/path/to?article http://journal_name.springer.com.sci-hub.hk/path/to?article I get the revoked SSL certificate Firefox 59
    - detaro 8y ago
      AFAIK Chrome doesn't check the CA revocation lists (but instead an aggregation of them by Google), so it doesn't know yet the cert is "bad".
    - icebraining 8y ago
      There does not seem to be any way - none that I could find - to get IE and Firefox to connect anyway? In Firefox, I think you can only by disabling the check (Preferences → Advanced → Certificates → Query OCSP ...). You probably don't want to keep that disabled, though.
theoctopus 8y ago
crt.sh reports it was revoked on the 26th: https://crt.sh/?id=274083328 https://crt.sh/?id=274083328
- icebraining 8y ago
  Issuer: COMODO That figures. When will we stop giving money to those scumbags? Trying to register the Let's Encrypt trademark was enough for me to never give them a cent again.
  - dlgeek 8y ago
    I doubt they just went out and did it randomly. I'd guess it was done via court order. The ACS got a court order against them that also ordered that 'internet search engines, web hosting sites, internet service providers (ISPs), domain name registrars and domain name registries cease facilitating “any or all domain names and websites through which Defendant Sci-Hub engages in unlawful access to, use, reproduction, and distribution of the ACS Marks or ACS's Copyrighted Works.”' (https://www.sciencemag.org/news/2017/11/court-demands-search-engines-and-internet-service-providers-block-sci-hub https://www.sciencemag.org/news/2017/11/court-demands-search...) Alternatively, Microsoft might have had something to do with it (they're super anti-piracy, and have a contract with all the CAs that requires them to unilaterally revoke any cert at Microsoft's discretion), but I think that's far less likely than the court order.
    - gruez 8y ago
      >they're super anti-piracy, and have a contract with all the CAs that requires them to unilaterally revoke any cert at Microsoft's discretion source?
      - dlgeek 8y ago
        https://social.technet.microsoft.com/wiki/contents/articles/31633.microsoft-trusted-root-program-requirements.aspx#Continuing_Program_Requirements https://social.technet.microsoft.com/wiki/contents/articles/... > If Microsoft, it its sole discretion, identifies a DV Server Authentication certificate is being used to promote malware or unwanted software, Microsoft will contact the responsible CA and request that it revoke the certificate. The CA must either revoke the certificate within a commercially-reasonable timeframe, or it must request an exception from Microsoft within two (2) business days of receiving Microsoft’s request. Microsoft may either grant or deny the exception at its sole discretion. In the event that Microsoft does not grant the exception, the CA must revoke the certificate within a commercially-reasonable timeframe not to exceed two (2) business days.
deleted 8y ago
[deleted]
Rjevski 8y ago
It’s a sign of trouble, but I’m not sure it’s really “further” trouble, all it takes is for them to get a cert from Let’s Encrypt and call it a day. I’m surprised they weren’t using LE to begin with actually - since LE is available, why would you ever pay for another CA (excluding EV certificates)?
- userbinator 8y ago
  ...and then LE also revokes their certificate.
  - mynewtb 8y ago
    That is a really farfetched scenario which I would never imagine happening. LE are not Cloudflare, I am sure they would not ridicule their neutral mission without actual legal force.
    - sillysaurus3 8y ago
      Unfortunately it's not far fetched. I wish it were. It's just an unpleasant thought we've decided not to think about. LE are a US corp, subject to US laws, and at the whim of US court orders. The implications of that are worth gaming out. Our laws are (arguably) mostly fair. But there are cases where they're not. Picture a world where an administration rises to power in the US on a platform that seems insane, but everybody endorses it anyway. And this platform just so happens to be against the sort of thing you're trying to do on the internet. Sci-hub are stealing. We as a community are mostly fine with that. We don't consider it stealing, because the moral good outweighs the bad by a hundred to one. But this isn't about Sci-hub. This is about a world in which we're free to do as we please, because we have the ability to decide what we want to do. If we want to make a site that can make information available, and someone else doesn't like that information or feels that they own it, what do you do? You have no power. And when you blindly put your faith in institutions like Let's Encrypt on their platform of openness and trust, you set yourself up for a shift: One day you wake up and find out you were mistaken, and we were all mistaken to push this centralized model in the name of security and convenience. And of course, that's the fundamental truth, isn't it? Liberties have always been eroded by pushing security and convenience. We should think carefully about who we trust, and why.
ridgeguy 8y ago
http://sci-hub.tw http://sci-hub.tw working here (Safari, MacOS) Sunday 8am in CA.
- csydas 8y ago
  Similarly, the certificate I'm seeing on sci-hub.hk is set to expire in 2019, issued by COMODO. Connecting from St. Petersburg Russia.
  - icebraining 8y ago
    It's not the expiration date; they used OCSP[1] to revoke it earlier. Your browser is probably just not looking up the certificate status on the OCSP server. [1] https://en.wikipedia.org/wiki/Online_Certificate_Status_Protocol https://en.wikipedia.org/wiki/Online_Certificate_Status_Prot...
  - lucb1e 8y ago
    http://sci-hub.hk http://sci-hub.hk works, but https://sci-hub.hk https://sci-hub.hk gives me a revoked certificate error which I can't seem to work around in Firefox 55. Connecting from Belgium.
evocation 8y ago
COMODO has revoked their certificate, probably under a court order. You can temporarily work around this by disabling 'Query OCSP responder servers to confirm the current validity of certificates' under Privacy & Security in Firefox.
- dest 8y ago
  and not forgetting to enable back the OCSP queries once you have finished browsing Sci-Hub!
ryanlol 8y ago
From a few days ago: https://news.ycombinator.com/item?id=16938593 https://news.ycombinator.com/item?id=16938593
ce4 8y ago
Related: https://news.ycombinator.com/item?id=16938593 https://news.ycombinator.com/item?id=16938593 Edit: The author registered Stripe Inc. in a different state than the payment processor and acquired an EV cert which got revoked.
salawat 8y ago
This type of thing is my number one objection to Certificate Authorities. In fact, it's my objection to computation illiteracy being acceptable in general amongst users. Devs and agencies cannot be trusted not to screw with things. If the average Joe cannot understand what is going on behind the curtains, they aren't free. Freedom is a scary thing to many groups, and unfortunately, more and more we are seeing the pendulum swing further and further away from the Internet's original intent: to facilitate the fast and open communication of information. I want to say free and open, but unfortunately I have trouble being able to maintain that level of idealism anymore.
- ethbro 8y ago
  Well said. I blame 2nd coming Jobs (iMac and iPod era) and same period Microsoft for a lot of this as they competed with each other. Usability became more important than flexibility. And intuitive operation prioritized over ease of learning. There's a lot to be said for a harder to use computer with a learning curve, but which affords you more power to be a creator instead of a consumer at the end of the curve. I'd go so far as to say that's better for us (as in, all humans).
  - userbinator 8y ago
    More importantly, the ability to write and run your own code easily, of which learning is only part of the process. From that perspective, Apple was closed from almost the beginning, while the PC and various other micros of the time (ZX, C64, etc.) started out open.
    - majjam 8y ago
      I found the early macos’ (6,7,8 and 9) incredibly frustrating for this reason. Pc users has dos and qbasic, but other than hypercard, mac didnt seem to have a way into the internals to learn about coding. Stuck in userland.
    - teh_klev 8y ago
      The Apple ][ wasn't closed, you could hack away on it just as much as any other 8bit machine of the day. I think (correct me if I'm wrong) it was from the Mac onward life got a bit more challenging.
awinter-py 8y ago
Max Weber wrote the government has a monopoly on the legitimate use of force while arguing that we trade safety for freedom to build modern societies. Going forward the ability to trust information will matter as much as physical safety. We're starting to build institutions that regulate that for us, CAs are one of the first. Depending on where you stand this is either a success or a failure of institutional trust.
- dredmorbius 8y ago
  Keep in mind all of Weber's argument. Government has a monopoly on the legitimate use of force. Weber claims that the state is the "only human Gemeinschaft which lays claim to the monopoly on the legitimated use of physical force. However, this monopoly is limited to a certain geographical area, and in fact this limitation to a particular area is one of the things that defines a state."[2] In other words, Weber describes the state as any organization that succeeds in holding the exclusive right to use, threaten, or authorize physical force against residents of its territory. Such a monopoly, according to Weber, must occur via a process of legitimation. https://en.wikipedia.org/wiki/Monopoly_on_violence https://en.wikipedia.org/wiki/Monopoly_on_violence This is mis-read by many Libertarians, including Charles Koch,[1] who directly funds a wide set of Libertarian institutional propaganda mills,[2] that this invalidates government. It does not. Absent a monopoly, there are multiple parties that claim legitimacy over use of force, including lical strongmen, tribes, or corporations, for all of which there is an extensive history of same (including Koch Industries, to the present). Government's monopoly is not for unlimited use of force, but for legitimate use. And if some alternate structure emerges claiming this right, it is, ipso facto, government. It is also possible for actual or nominal governments' use of force to be illegitimate. Which it rather frequently is. ________________________________ Notes: 1. https://www.marketplace.org/2015/10/21/business/corner-office/full-interview-charles-koch https://www.marketplace.org/2015/10/21/business/corner-offic... 2. Amply documented, see: https://en.wikipedia.org/wiki/Political_activities_of_the_Koch_brothers https://en.wikipedia.org/wiki/Political_activities_of_the_Ko... https://www.sourcewatch.org/index.php/Koch_Brothers https://www.sourcewatch.org/index.php/Koch_Brothers
  - CamperBob2 8y ago
weavie 8y ago
What's there to stop them self signing their cert and allowing everyone interested to add it to their certificate store?
- kevingrahl 8y ago
  I‘d imagine it’s because the average user is pretty dumb and probably not able/willing to go that extra step of adding a certificate manually.
  - bdcravens 8y ago
    I wouldn't say someone is dumb because they don't understand how SSL in the browser works. In the same sense I'm not dumb because I can't perform heart surgery.
    - posterboy 8y ago
      Dumb in the sense of "will not say anything, not complain nor ask question", you know, literally mute.
return1 8y ago
shouldnt we be using some trustless system for encryption by now?
- saagarjha 8y ago
  Easier said than done…
uberman 8y ago
I'm a little confused. Setting aside the legal/ethical underpinnings.. Is the issue here that people are worried that an SA can revoke a cert or that it will be harder for the layperson to get to this particular site?
- mirimir 8y ago
  Both, I think. The certificate has clearly been revoked.[0] If Sci-Hub requested that, no problem. But if some third party did it, that's clearly a vulnerability. And yes, the impact is that many people lose access. Or need to access via HTTP instead of HTTPS. Which exposes information about what they access. Unless the use the Tor onion site, which is maybe beyond most people's skills. 0) https://crt.sh/?id=274083328 https://crt.sh/?id=274083328
mirimir 8y ago
Also, http://scihub22266oqcxt.onion/ http://scihub22266oqcxt.onion/ is down. And there's no mention of an onion link on the Sci-Hub website. I wonder what's up.
otterlicious 8y ago
Only one of the domain/wildcard pairs listed in Sci-Hub's certificate actually works for me right now. It's probable the certificate was revoked not because some publisher threatened legal action against Comodo, but because Sci-Hub no longer controls some of the domains listed in their certificate. If this is the case then they would be able to get a new certificate for free with those names removed. I wouldn't go rushing to blame Comodo for kowtowing to publishers' demands until Alexandra tells us that's what actually happened...
- deleted 8y ago
  [deleted]
piracy1 8y ago
The onion domain should be fine because tor has it's own encryption/verification scheme built into their DNS. The domain is the public key (a derivative of it) and the private key is used to sign data.

244 points by AlbertoGP 8y ago

06983234 8y ago

This is exactly what I said would happen when Google started making all of us use HTTPS.

detaro 8y ago
What is "this"?
- 06983234 8y ago
  Being wiped from the internet by a disagreeable CA authority. If that is what "this" is.
  - middleclick 8y ago
    FWIW, onion addresses don't require a cert, they are end-to-end encrypted by design.
    - mynameisvlad 8y ago
      Technically, nothing requires a cert. It's just best practice to have one.
  - matthewmacleod 8y ago
    That is not what "this" is.
    - codedokode 8y ago
      The grandparent comment is right. I am not going to mess with default browser settings, and almost nobody is.
  - MikkoFinell 8y ago
    http://sci-hub.tw/ http://sci-hub.tw/ is reachable no problem. Cut down on the hyperbole please.
- AnIdiotOnTheNet 8y ago
  Likely they mean censorship via certificate revocation, which it isn't clear yet that this is, but they have a valid point. If you put control over your trust in a third party, you give them the power to do this kind of thing.
  - tscs37 8y ago
    You can always manually trust certificates via various means, it's the basis for almost any corporate network, most browsers also offer a simply dialog to bypass certificate warnings.
    - detaro 8y ago
      You can also just use HTTP, since sci-hub doesn't force HTTPS.
    - 0x00000000 8y ago
      Browsers seem to be moving towards making it harder to bypass, which is probably a good thing for the average user. I wouldn't be surprised to see the ability to ignore https errors (or access http sites at all) locked behind a developer setting or something.
      - tscs37 8y ago
        On Chrome I can see that but I doubt Firefox would make that move. Plus, they won't remove the functionality to manually trust a cert (Business Users would complain).
        Sir_Substance 8y ago
        > On Chrome I can see that but I doubt Firefox would make that move. Firefox has implemented the same rules around .dev tld's as google. I use vivaldi when accessing internal company .dev domains because firefox won't let me tell it to accept the self-signed certificate.
googledystopia 8y ago
Oh, look. Google as the absolute arbiter of information. Who could've ever predicted that they'd start using their position for evil?
- detaro 8y ago
  How exactly do you see Google doing anything here, outside of a general "they encourage HTTPS" (but the site still works fine over HTTP)?
userbinator 8y ago
You're not the only one. I hypothesised about this before in previous SciHub discussions, and SciHub isn't the only site that is/will be affected. Security is the ostensible benefit, and it's the one they advertise the most; easier censorship and centralised access control is the other---something which a lot of the pro-(traditional)-HTTPS advocates don't advertise. Make HTTPS mandatory (so no more HTTP), make it near impossible to bypass in browsers, and you have created a very effective censorship system controlled by the CAs and whatever interests they serve. Slowly ostracising and forcing "compliance" of those who don't toe the line is easier than before. They want you to be obedient sheep, living in an illusion of security and safety while continuing to mindlessly consume under their control. I will resist the urge to post that memorable Franklin quote.
- x0x0 8y ago
  Let's not pretend the real reason google isn't so gung-ho about https everywhere is to prevent the ISPs from muscling into their businesses: * ads on page * seeing all internet traffic to enhance targeting
  - dagenix 8y ago
    You make it sound like this is a bad thing. Regardless of if it also benefits Google's business model, both of these things benefit users and website owners. The only thing that benefits from injecting ads into a page or deeper ISP tracking is some ISP executive's bonus.
    - dagenix 8y ago
      Challenge: Next person that downvotes me, also leave a comment explaining why.
- saagarjha 8y ago
  But then you have the other issue of your ISP having the ability to meddle with what it's sending you and silently injecting or removing content from the page. Really, I don't see a great solution either way.

agumonkey 8y ago

It probably depends on what domain youre using.

AlbertoGP 8y ago
This seems to affect all their domain variants, but it still works without encryption: http://sci-hub.tw http://sci-hub.tw Edit: already noted by detaro https://news.ycombinator.com/item?id=16952051 https://news.ycombinator.com/item?id=16952051
- ItsMe000001 8y ago
  I just tried https://sci-hub.tw/ https://sci-hub.tw/ (Chrome) and got a secure connection without warnings. Since the issuer of the certificate that my browser showed for the connection is "Comodo" I guess the revocation didn't reach my browser yet? EDIT: IE and Firefox say "insecure". What really annoys me: There does not seem to be any way - none that I could find - to get IE and Firefox to connect anyway?
  - a_bonobo 8y ago
    On sci-hub.hk I get a non-SSL connection, if I try the 'trick' of http://journal_name.springer.com.sci-hub.hk/path/to?article http://journal_name.springer.com.sci-hub.hk/path/to?article I get the revoked SSL certificate Firefox 59
  - detaro 8y ago
    AFAIK Chrome doesn't check the CA revocation lists (but instead an aggregation of them by Google), so it doesn't know yet the cert is "bad".
  - icebraining 8y ago
    There does not seem to be any way - none that I could find - to get IE and Firefox to connect anyway? In Firefox, I think you can only by disabling the check (Preferences → Advanced → Certificates → Query OCSP ...). You probably don't want to keep that disabled, though.

theoctopus 8y ago

crt.sh reports it was revoked on the 26th: https://crt.sh/?id=274083328 https://crt.sh/?id=274083328

icebraining 8y ago
Issuer: COMODO That figures. When will we stop giving money to those scumbags? Trying to register the Let's Encrypt trademark was enough for me to never give them a cent again.
- dlgeek 8y ago
  I doubt they just went out and did it randomly. I'd guess it was done via court order. The ACS got a court order against them that also ordered that 'internet search engines, web hosting sites, internet service providers (ISPs), domain name registrars and domain name registries cease facilitating “any or all domain names and websites through which Defendant Sci-Hub engages in unlawful access to, use, reproduction, and distribution of the ACS Marks or ACS's Copyrighted Works.”' (https://www.sciencemag.org/news/2017/11/court-demands-search-engines-and-internet-service-providers-block-sci-hub https://www.sciencemag.org/news/2017/11/court-demands-search...) Alternatively, Microsoft might have had something to do with it (they're super anti-piracy, and have a contract with all the CAs that requires them to unilaterally revoke any cert at Microsoft's discretion), but I think that's far less likely than the court order.
  - gruez 8y ago
    >they're super anti-piracy, and have a contract with all the CAs that requires them to unilaterally revoke any cert at Microsoft's discretion source?
    - dlgeek 8y ago
      https://social.technet.microsoft.com/wiki/contents/articles/31633.microsoft-trusted-root-program-requirements.aspx#Continuing_Program_Requirements https://social.technet.microsoft.com/wiki/contents/articles/... > If Microsoft, it its sole discretion, identifies a DV Server Authentication certificate is being used to promote malware or unwanted software, Microsoft will contact the responsible CA and request that it revoke the certificate. The CA must either revoke the certificate within a commercially-reasonable timeframe, or it must request an exception from Microsoft within two (2) business days of receiving Microsoft’s request. Microsoft may either grant or deny the exception at its sole discretion. In the event that Microsoft does not grant the exception, the CA must revoke the certificate within a commercially-reasonable timeframe not to exceed two (2) business days.

deleted 8y ago

[deleted]

Rjevski 8y ago

It’s a sign of trouble, but I’m not sure it’s really “further” trouble, all it takes is for them to get a cert from Let’s Encrypt and call it a day. I’m surprised they weren’t using LE to begin with actually - since LE is available, why would you ever pay for another CA (excluding EV certificates)?

userbinator 8y ago
...and then LE also revokes their certificate.
- mynewtb 8y ago
  That is a really farfetched scenario which I would never imagine happening. LE are not Cloudflare, I am sure they would not ridicule their neutral mission without actual legal force.
  - sillysaurus3 8y ago
    Unfortunately it's not far fetched. I wish it were. It's just an unpleasant thought we've decided not to think about. LE are a US corp, subject to US laws, and at the whim of US court orders. The implications of that are worth gaming out. Our laws are (arguably) mostly fair. But there are cases where they're not. Picture a world where an administration rises to power in the US on a platform that seems insane, but everybody endorses it anyway. And this platform just so happens to be against the sort of thing you're trying to do on the internet. Sci-hub are stealing. We as a community are mostly fine with that. We don't consider it stealing, because the moral good outweighs the bad by a hundred to one. But this isn't about Sci-hub. This is about a world in which we're free to do as we please, because we have the ability to decide what we want to do. If we want to make a site that can make information available, and someone else doesn't like that information or feels that they own it, what do you do? You have no power. And when you blindly put your faith in institutions like Let's Encrypt on their platform of openness and trust, you set yourself up for a shift: One day you wake up and find out you were mistaken, and we were all mistaken to push this centralized model in the name of security and convenience. And of course, that's the fundamental truth, isn't it? Liberties have always been eroded by pushing security and convenience. We should think carefully about who we trust, and why.

ridgeguy 8y ago

http://sci-hub.tw http://sci-hub.tw working here (Safari, MacOS) Sunday 8am in CA.

csydas 8y ago
Similarly, the certificate I'm seeing on sci-hub.hk is set to expire in 2019, issued by COMODO. Connecting from St. Petersburg Russia.
- icebraining 8y ago
  It's not the expiration date; they used OCSP[1] to revoke it earlier. Your browser is probably just not looking up the certificate status on the OCSP server. [1] https://en.wikipedia.org/wiki/Online_Certificate_Status_Protocol https://en.wikipedia.org/wiki/Online_Certificate_Status_Prot...
- lucb1e 8y ago
  http://sci-hub.hk http://sci-hub.hk works, but https://sci-hub.hk https://sci-hub.hk gives me a revoked certificate error which I can't seem to work around in Firefox 55. Connecting from Belgium.

evocation 8y ago

COMODO has revoked their certificate, probably under a court order. You can temporarily work around this by disabling 'Query OCSP responder servers to confirm the current validity of certificates' under Privacy & Security in Firefox.

dest 8y ago
and not forgetting to enable back the OCSP queries once you have finished browsing Sci-Hub!

ryanlol 8y ago

From a few days ago: https://news.ycombinator.com/item?id=16938593 https://news.ycombinator.com/item?id=16938593

ce4 8y ago

Related: https://news.ycombinator.com/item?id=16938593 https://news.ycombinator.com/item?id=16938593 Edit: The author registered Stripe Inc. in a different state than the payment processor and acquired an EV cert which got revoked.

salawat 8y ago

This type of thing is my number one objection to Certificate Authorities. In fact, it's my objection to computation illiteracy being acceptable in general amongst users. Devs and agencies cannot be trusted not to screw with things. If the average Joe cannot understand what is going on behind the curtains, they aren't free. Freedom is a scary thing to many groups, and unfortunately, more and more we are seeing the pendulum swing further and further away from the Internet's original intent: to facilitate the fast and open communication of information. I want to say free and open, but unfortunately I have trouble being able to maintain that level of idealism anymore.

ethbro 8y ago
Well said. I blame 2nd coming Jobs (iMac and iPod era) and same period Microsoft for a lot of this as they competed with each other. Usability became more important than flexibility. And intuitive operation prioritized over ease of learning. There's a lot to be said for a harder to use computer with a learning curve, but which affords you more power to be a creator instead of a consumer at the end of the curve. I'd go so far as to say that's better for us (as in, all humans).
- userbinator 8y ago
  More importantly, the ability to write and run your own code easily, of which learning is only part of the process. From that perspective, Apple was closed from almost the beginning, while the PC and various other micros of the time (ZX, C64, etc.) started out open.
  - majjam 8y ago
    I found the early macos’ (6,7,8 and 9) incredibly frustrating for this reason. Pc users has dos and qbasic, but other than hypercard, mac didnt seem to have a way into the internals to learn about coding. Stuck in userland.
  - teh_klev 8y ago
    The Apple ][ wasn't closed, you could hack away on it just as much as any other 8bit machine of the day. I think (correct me if I'm wrong) it was from the Mac onward life got a bit more challenging.

awinter-py 8y ago

Max Weber wrote the government has a monopoly on the legitimate use of force while arguing that we trade safety for freedom to build modern societies. Going forward the ability to trust information will matter as much as physical safety. We're starting to build institutions that regulate that for us, CAs are one of the first. Depending on where you stand this is either a success or a failure of institutional trust.

dredmorbius 8y ago
Keep in mind all of Weber's argument. Government has a monopoly on the legitimate use of force. Weber claims that the state is the "only human Gemeinschaft which lays claim to the monopoly on the legitimated use of physical force. However, this monopoly is limited to a certain geographical area, and in fact this limitation to a particular area is one of the things that defines a state."[2] In other words, Weber describes the state as any organization that succeeds in holding the exclusive right to use, threaten, or authorize physical force against residents of its territory. Such a monopoly, according to Weber, must occur via a process of legitimation. https://en.wikipedia.org/wiki/Monopoly_on_violence https://en.wikipedia.org/wiki/Monopoly_on_violence This is mis-read by many Libertarians, including Charles Koch,[1] who directly funds a wide set of Libertarian institutional propaganda mills,[2] that this invalidates government. It does not. Absent a monopoly, there are multiple parties that claim legitimacy over use of force, including lical strongmen, tribes, or corporations, for all of which there is an extensive history of same (including Koch Industries, to the present). Government's monopoly is not for unlimited use of force, but for legitimate use. And if some alternate structure emerges claiming this right, it is, ipso facto, government. It is also possible for actual or nominal governments' use of force to be illegitimate. Which it rather frequently is. ________________________________ Notes: 1. https://www.marketplace.org/2015/10/21/business/corner-office/full-interview-charles-koch https://www.marketplace.org/2015/10/21/business/corner-offic... 2. Amply documented, see: https://en.wikipedia.org/wiki/Political_activities_of_the_Koch_brothers https://en.wikipedia.org/wiki/Political_activities_of_the_Ko... https://www.sourcewatch.org/index.php/Koch_Brothers https://www.sourcewatch.org/index.php/Koch_Brothers
- CamperBob2 8y ago

weavie 8y ago

What's there to stop them self signing their cert and allowing everyone interested to add it to their certificate store?

kevingrahl 8y ago
I‘d imagine it’s because the average user is pretty dumb and probably not able/willing to go that extra step of adding a certificate manually.
- bdcravens 8y ago
  I wouldn't say someone is dumb because they don't understand how SSL in the browser works. In the same sense I'm not dumb because I can't perform heart surgery.
  - posterboy 8y ago
    Dumb in the sense of "will not say anything, not complain nor ask question", you know, literally mute.

return1 8y ago

shouldnt we be using some trustless system for encryption by now?

saagarjha 8y ago
Easier said than done…

uberman 8y ago

I'm a little confused. Setting aside the legal/ethical underpinnings.. Is the issue here that people are worried that an SA can revoke a cert or that it will be harder for the layperson to get to this particular site?

mirimir 8y ago
Both, I think. The certificate has clearly been revoked.[0] If Sci-Hub requested that, no problem. But if some third party did it, that's clearly a vulnerability. And yes, the impact is that many people lose access. Or need to access via HTTP instead of HTTPS. Which exposes information about what they access. Unless the use the Tor onion site, which is maybe beyond most people's skills. 0) https://crt.sh/?id=274083328 https://crt.sh/?id=274083328

mirimir 8y ago

Also, http://scihub22266oqcxt.onion/ http://scihub22266oqcxt.onion/ is down. And there's no mention of an onion link on the Sci-Hub website. I wonder what's up.

otterlicious 8y ago

Only one of the domain/wildcard pairs listed in Sci-Hub's certificate actually works for me right now. It's probable the certificate was revoked not because some publisher threatened legal action against Comodo, but because Sci-Hub no longer controls some of the domains listed in their certificate. If this is the case then they would be able to get a new certificate for free with those names removed. I wouldn't go rushing to blame Comodo for kowtowing to publishers' demands until Alexandra tells us that's what actually happened...

deleted 8y ago
[deleted]

piracy1 8y ago

The onion domain should be fine because tor has it's own encryption/verification scheme built into their DNS. The domain is the public key (a derivative of it) and the private key is used to sign data.