5 ms·

Yeah, you don't want to use this.

dfc 13y ago
I thought it was a great idea for strengthening the gpg/gpg web of trust. Outside of debian there is/was very little in the way of organized efforts to improve the web of trust. However I do not think it is a great idea for browser certificates. At least not until there are serious improvements to the CA configuration UI and user education.
thejosh 13y ago
Reason why?
- jlgaddis 13y ago
  Because he works for a CA.
rurban 13y ago
You do want to support a non-commercial and community driven CA cert authority, because you don't want to rely on commercial-only cert's which are not based on technical merits, just on friendship and common business interests. You really want a free HTTPS connection to your favorite open source projects login page, and do not force them to pay yearly CA update fees to not trustworthy cert authorities for no reason. Currently you need to add the cacert into your keychain on some distros manually. See http://wiki.cacert.org/FAQ/ImportRootCert http://wiki.cacert.org/FAQ/ImportRootCert
- abritishguy 13y ago
  Certificates are not expensive, they can be picked up for $5.
  - rurban 13y ago
    Why should I pay a not-trustworthy company, when I can get one for free, from a widely respected and completely open sourced and community managed authority?
    - abritishguy 13y ago
      "not-trustworthy" The process of obtaining an SSL certificate does not involve divulging your private key to the CA so what are you trusting them with? In reality you are trusting them not to sign certificates for sites not owned or administered by the person requesting it, they could (in theory) do this whether you got your certificate from them or not. In practice they cannot do this on a widespread scale without it being detected (e.g. Chrome sends info to Google if a certificate for a google domain is valid but not from the Google Internet Authority) and as soon as that happens then they lose their business (as is what happened to a CA that got hacked).
      - pgeorgi 13y ago
        It's the same kind of non-trust you (and others) assert over CAcert. See how well that model worked with Comodo and TurkTrust - both of which are still in business and in default CA lists, which is counter to your assertion that careful CA operation makes business sense. Unfortunately there's no will with browser vendors to _really_ improve matters (maybe TACK?), so something like CAcert is great should it get implemented (providing some heat to CA providers) and even when not (by showing the browser vendors' hypocrisy).
  - Karunamon 13y ago
    Where would this be? And do they attempt to charge money on things that really don't need it? I.e. rekeys and renewals? What about wildcard domains? The same damn cert with a *. instead of a domain. shouldn't cost 10x more.
    - abritishguy 13y ago
      I sell certificates: https://www.volcanicpixels.com/ssl/ https://www.volcanicpixels.com/ssl/ You can get the same certificates for much cheaper here: https://www.thesslstore.com/ https://www.thesslstore.com/ The certificates are absolutely identical, my customers use my site because it is well designed and easy to use and I do everything I can to provide great support, but if you know exactly what you are doing then I would recommend getting them directly from thesslstore - unless you have a desire to help pay for my uni education ;)
      - Karunamon 13y ago
        Thanks for pointing it out to me, but there are still some big failures there. First, the site appears broken. The "Purchase SSL" link on the front page goes to a 404. Second, the absolute cheapest certificate I could find anywhere was Certum's BasicID which costs $9.95 for one year. Third, the dark pattern of presenting a lower price up front ($8), but then you find that this only applies if you spring for more than one year. Misleading and weak. Finally, A wildcard certificate from the same company appears to cost $65.83/yr, (which goes up to $79.00 once you click on the link and realize that was the three year price.) Not going to lie, this website leaves me feeling very skewed out, and still costs too much for what you're getting anyways.
        abritishguy 13y ago
        Sorry, I haven't looked at the site in a while and it has changed a lot. Wildcard certificates are rarely economical compared with just buying individual certs for the subdomains. > the dark pattern of presenting a lower price up front ($8), but then you find that this only applies if you spring for more than one year. Misleading and weak. Absolutely agree! If you send me an email then I'll make you a coupon to get a certificate for £5 (just over cost price) on my site: https://www.volcanicpixels.com/ssl/ https://www.volcanicpixels.com/ssl/ (which is open source: https://github.com/volcanicpixels/volcanicpixels/ https://github.com/volcanicpixels/volcanicpixels/)
  - nomailing 13y ago
    5$ is expensive. Don't you know that there are other countries in the world and that the Internet is not only used by the US. There are also other age groups. If a 10 year old boy has a hobby website 5$ might be a price which is unacceptable. what would you say if I as a billionaire tell you that cars for less than 50 000 $ are not needed because all Ferraris are not expensive. So please don't use your subjective experience as an argument against cheap security solutions. They have a point to exist. Nobody should have the right to set the lower limit of how much you have to pay to secure your website. Commericial CAs cannot guarantee the security of your favorite site as we all learned from the heartbleed bug. So there is nit argument to favor them and block community solutions.
    - abritishguy 13y ago
      I'm not American, so yes I am well aware. >If a 10 year old boy has a hobby website 5$ might be a price which is unacceptable. Why would this site need SSL?
      - aragot 13y ago
        Because he has users and he wants to keep their private info under encrypted channels? Hobby sites quickly become apps (even as small as phpBB) and it would be good if we SSL'd everything.
    - lawnchair_larry 13y ago
      http://en.wikipedia.org/wiki/Reductio_ad_absurdum http://en.wikipedia.org/wiki/Reductio_ad_absurdum A 10 year old with a hobby site in a third world country doesn't need a $5 certificate. Neither does a rich 10 year old with a hobby site for that matter, but he can purchase one if he wants.
  - quasque 13y ago
    They can even be picked up for free. At least one commercial CA issues free certificates as a matter of routine and (unlike CAcert) has its root certificate in all major OSes and browsers. Alternatively, if you already have a paid cert then some providers offer a free cert via 'competitive upgrade' programmes, if you switch to them (rather unethically, this also used to work to freely upgrade short-term trial certificates to full ones).
    - abritishguy 13y ago
      Startcom charge for revocations though, which IMO is a very bad thing.
      - quasque 13y ago
        They do, but I'm not convinced that it matters - I'd be very surprised if there's any overlap between websites that use the free StartSSL cert, and websites that are worth the effort of hijacking the cert and MITMing.
- dfc 13y ago
  I do not want to support a non-commercial and community driven CA cert authority[sic] that does not meet commonly accepted CA audit requirements. My favorite open source project's login page can use self signed cert. I can download the ssl.key.asc or project.crt.asc that the project publishes on the web page or git repository and verify the signatures using the same gpg key I use to verify the project tarballs.
- lawnchair_larry 13y ago
  None of what you are saying actually matters (regardless of one's position on those issues), because it's trumped by the fact that if you use cacert, users can't reach your site. It's wrong to defer this problem to the user, always.

dfc 13y ago

I thought it was a great idea for strengthening the gpg/gpg web of trust. Outside of debian there is/was very little in the way of organized efforts to improve the web of trust. However I do not think it is a great idea for browser certificates. At least not until there are serious improvements to the CA configuration UI and user education.

thejosh 13y ago

Reason why?

jlgaddis 13y ago
Because he works for a CA.

rurban 13y ago

You do want to support a non-commercial and community driven CA cert authority, because you don't want to rely on commercial-only cert's which are not based on technical merits, just on friendship and common business interests. You really want a free HTTPS connection to your favorite open source projects login page, and do not force them to pay yearly CA update fees to not trustworthy cert authorities for no reason. Currently you need to add the cacert into your keychain on some distros manually. See http://wiki.cacert.org/FAQ/ImportRootCert http://wiki.cacert.org/FAQ/ImportRootCert

abritishguy 13y ago
Certificates are not expensive, they can be picked up for $5.
- rurban 13y ago
  Why should I pay a not-trustworthy company, when I can get one for free, from a widely respected and completely open sourced and community managed authority?
  - abritishguy 13y ago
    "not-trustworthy" The process of obtaining an SSL certificate does not involve divulging your private key to the CA so what are you trusting them with? In reality you are trusting them not to sign certificates for sites not owned or administered by the person requesting it, they could (in theory) do this whether you got your certificate from them or not. In practice they cannot do this on a widespread scale without it being detected (e.g. Chrome sends info to Google if a certificate for a google domain is valid but not from the Google Internet Authority) and as soon as that happens then they lose their business (as is what happened to a CA that got hacked).
    - pgeorgi 13y ago
      It's the same kind of non-trust you (and others) assert over CAcert. See how well that model worked with Comodo and TurkTrust - both of which are still in business and in default CA lists, which is counter to your assertion that careful CA operation makes business sense. Unfortunately there's no will with browser vendors to _really_ improve matters (maybe TACK?), so something like CAcert is great should it get implemented (providing some heat to CA providers) and even when not (by showing the browser vendors' hypocrisy).
- Karunamon 13y ago
  Where would this be? And do they attempt to charge money on things that really don't need it? I.e. rekeys and renewals? What about wildcard domains? The same damn cert with a *. instead of a domain. shouldn't cost 10x more.
  - abritishguy 13y ago
    I sell certificates: https://www.volcanicpixels.com/ssl/ https://www.volcanicpixels.com/ssl/ You can get the same certificates for much cheaper here: https://www.thesslstore.com/ https://www.thesslstore.com/ The certificates are absolutely identical, my customers use my site because it is well designed and easy to use and I do everything I can to provide great support, but if you know exactly what you are doing then I would recommend getting them directly from thesslstore - unless you have a desire to help pay for my uni education ;)
    - Karunamon 13y ago
      Thanks for pointing it out to me, but there are still some big failures there. First, the site appears broken. The "Purchase SSL" link on the front page goes to a 404. Second, the absolute cheapest certificate I could find anywhere was Certum's BasicID which costs $9.95 for one year. Third, the dark pattern of presenting a lower price up front ($8), but then you find that this only applies if you spring for more than one year. Misleading and weak. Finally, A wildcard certificate from the same company appears to cost $65.83/yr, (which goes up to $79.00 once you click on the link and realize that was the three year price.) Not going to lie, this website leaves me feeling very skewed out, and still costs too much for what you're getting anyways.
      - abritishguy 13y ago
        Sorry, I haven't looked at the site in a while and it has changed a lot. Wildcard certificates are rarely economical compared with just buying individual certs for the subdomains. > the dark pattern of presenting a lower price up front ($8), but then you find that this only applies if you spring for more than one year. Misleading and weak. Absolutely agree! If you send me an email then I'll make you a coupon to get a certificate for £5 (just over cost price) on my site: https://www.volcanicpixels.com/ssl/ https://www.volcanicpixels.com/ssl/ (which is open source: https://github.com/volcanicpixels/volcanicpixels/ https://github.com/volcanicpixels/volcanicpixels/)
- nomailing 13y ago
  5$ is expensive. Don't you know that there are other countries in the world and that the Internet is not only used by the US. There are also other age groups. If a 10 year old boy has a hobby website 5$ might be a price which is unacceptable. what would you say if I as a billionaire tell you that cars for less than 50 000 $ are not needed because all Ferraris are not expensive. So please don't use your subjective experience as an argument against cheap security solutions. They have a point to exist. Nobody should have the right to set the lower limit of how much you have to pay to secure your website. Commericial CAs cannot guarantee the security of your favorite site as we all learned from the heartbleed bug. So there is nit argument to favor them and block community solutions.
  - abritishguy 13y ago
    I'm not American, so yes I am well aware. >If a 10 year old boy has a hobby website 5$ might be a price which is unacceptable. Why would this site need SSL?
    - aragot 13y ago
      Because he has users and he wants to keep their private info under encrypted channels? Hobby sites quickly become apps (even as small as phpBB) and it would be good if we SSL'd everything.
  - lawnchair_larry 13y ago
    http://en.wikipedia.org/wiki/Reductio_ad_absurdum http://en.wikipedia.org/wiki/Reductio_ad_absurdum A 10 year old with a hobby site in a third world country doesn't need a $5 certificate. Neither does a rich 10 year old with a hobby site for that matter, but he can purchase one if he wants.
- quasque 13y ago
  They can even be picked up for free. At least one commercial CA issues free certificates as a matter of routine and (unlike CAcert) has its root certificate in all major OSes and browsers. Alternatively, if you already have a paid cert then some providers offer a free cert via 'competitive upgrade' programmes, if you switch to them (rather unethically, this also used to work to freely upgrade short-term trial certificates to full ones).
  - abritishguy 13y ago
    Startcom charge for revocations though, which IMO is a very bad thing.
    - quasque 13y ago
      They do, but I'm not convinced that it matters - I'd be very surprised if there's any overlap between websites that use the free StartSSL cert, and websites that are worth the effort of hijacking the cert and MITMing.
dfc 13y ago
I do not want to support a non-commercial and community driven CA cert authority[sic] that does not meet commonly accepted CA audit requirements. My favorite open source project's login page can use self signed cert. I can download the ssl.key.asc or project.crt.asc that the project publishes on the web page or git repository and verify the signatures using the same gpg key I use to verify the project tarballs.
lawnchair_larry 13y ago
None of what you are saying actually matters (regardless of one's position on those issues), because it's trumped by the fact that if you use cacert, users can't reach your site. It's wrong to defer this problem to the user, always.