5 ms·

Still wish I had an option for encryption. - certs cost money, which I (and many other people I know) CANNOT[1] afford. StartSSL won't give me a cert (they did

by pdkl95 12y ago

Still wish I had an option for encryption. - certs cost money, which I (and many other people I know) CANNOT[1] afford. StartSSL won't give me a cert (they did previously, but want $$$ now). This problem affects more people than you probably realize. Remember that 15% of the population (48 million people people)[2] in the USA are below the poverty line. The internet has already been a powerful tool, accessible in various ways even at this end of the income spectrum. Despite that, the PKI system is serving as a barrier-to-entry if you want to encrypt. So I ask again: what is a FREE option for SSL. TCP, HTTP, DNS and most other protocols work fine once you can send packets, and do not require an extra regular fee. SSL does. Or is the intent to have secure communication only for those that can afford it - the rest of us doomed to plaintext or rejected as "self signed" by the SSL servers of the rich and middle class? Or are we supposed to only use the internet as if it was TV, and be forced to trust our plaintext with some 3rd party? sigh - I suspect the answer will instead be "[-1] Don't want to be reminded of the hard issues." [1] I realize that the idea of not having an extra $15 doesn't make sense to those of you with salaried jobs. Well, lets see you come up with that extra $15 on a tiny SSDI check. Domain (3rd level) is free. Internet is very cheap and flat-rate. An extra $15 would be some new(-ish) clothes, not a SSL cert. [2] https://www.census.gov/hhes/www/poverty/about/overview/ https://www.census.gov/hhes/www/poverty/about/overview/

MattJ100 12y ago
A self-signed certificate is free, you don't need a CA-issued certificate just to use encryption. Most XMPP servers on the internet today are forgiving of certificates they don't trust - they will encrypt the connection and then use "dialback" to authenticate you based on DNS. Obviously falling back to DNS is not as secure, and as mentioned in the blog post - there are people working on ways to allow people to use any certificate (including self-signed) securely.
- pdkl95 12y ago
  > Most XMPP servers on the internet today are forgiving of certificates they don't trust... I was not aware of that - I'll certainly investigate that possibility. > Obviously falling back to DNS is not as secure Of course, but it's still better than "plaintext".
scrollaway 12y ago
FWIW, if you get a domain with gandi.net, your first year of SSL cert is free, subsequent years are no more expensive than the domain itself. This is only for the basic single-domain cert though.
th0br0 12y ago
Why not use CA Cert? Sure, they're not included on Windows by default or (I believe) OS X but at least there's some level of trust.
- pdkl95 12y ago
  There service seemed... confusing. As you say, though, their cert is not included in win/osx, which makes it kind of useless re: client logins. (always trying to convert friends to a saner OS - with some success - but that's a slow process :/ )
ibotty 12y ago
hopefully dane fixes that.
dspillett 12y ago
> StartSSL won't give me a cert (they did previously, but want $$$ now) Do you have reference for that? I've been using their free certs for a few things for a while and a recent renewal was free. I'll be paying for one shortly, but that is only because I want a wildcard for one of my domains in order to save some faf. I suspect your problem is the "third level domain" thing: they would effectively need to have permission from the over of the next level up to sign a cert on your behalf for one of their names (or you would need your domain provider to take part in the validation process). > for those that can afford it - the rest of us doomed to plaintext or rejected as "self signed" That certainly isn't the intention of the security community, but until a method is found that allows certificates to be freely produced without the security risks involved with self-signed certs that is what we (well, those in the poverty trap) are stuck with. How StartSSL arrange their business model seems to be one solution, your current problem above not withstanding. If the depth of your free domain is the issue then perhaps the solution lies with the domain registrant taking the cost of a wildcard certificate (~$30/yr with startssl, ~$60/yr elsewhere) and so their subscribers can use it for SSL. They would have to proxy web requests to you though (with something like nginx in a reverse proxy configuration), so it would not be a zero admin option and would cost them in extra bandwidth requirements too unless they already host your content (rather than just responding to DNS requests for content hosted elsewhere), otherwise the only way you could use the cert is for you to know the private key which breaks the assurance model completely. Perhaps you could convince a provider of third level domains that taking these steps could give them with a competitive advantage over similar providers who do not.
- igravious 12y ago
  Slightly off-topic but, in your opinion, how does StartSSL compare to CAcert? I'm about to jump and would like to know where I'm landing.
  - LeoPanthera 12y ago
    The CAcert root cert is trusted almost nowhere, so they are not comparable. StartSSL certs are trusted by almost all major OSs and browsers.
makomk 12y ago
StartSSL-issued free certificates don't work reliably for XMPP in my experience anyway - some clients insist that the CN must be set to the top-level domain name and StartSSL won't issue free certificates with that configuration. I wouldn't be surprised if some XMPP servers had the same issue too.
- Zash 12y ago
  Then those clients are broken and should get fixed.
- mmastrac 12y ago
  Are the StartSSL free certs limited to something.example.tld? I've been using the inexpensive company-validated ones ($120 for two years) with a wildcart cert personally and haven't had that issue, so I'm unfamiliar with their free offering.
  - agwa 12y ago
    As of 2013, if you get a free cert for something.example.tld, it also includes a subjectAltName for example.tld (which is usually desirable if something is "www" but undesirable if it's something else).
zokier 12y ago
The best option for you currently would be to pool some money from friends/family to buy SSL cert collectively. It probably makes sense anyways to share the server instead of everyone hosting their own.

by pdkl95 12y ago

MattJ100 12y ago

A self-signed certificate is free, you don't need a CA-issued certificate just to use encryption. Most XMPP servers on the internet today are forgiving of certificates they don't trust - they will encrypt the connection and then use "dialback" to authenticate you based on DNS. Obviously falling back to DNS is not as secure, and as mentioned in the blog post - there are people working on ways to allow people to use any certificate (including self-signed) securely.

pdkl95 12y ago
> Most XMPP servers on the internet today are forgiving of certificates they don't trust... I was not aware of that - I'll certainly investigate that possibility. > Obviously falling back to DNS is not as secure Of course, but it's still better than "plaintext".

scrollaway 12y ago

FWIW, if you get a domain with gandi.net, your first year of SSL cert is free, subsequent years are no more expensive than the domain itself. This is only for the basic single-domain cert though.

th0br0 12y ago

Why not use CA Cert? Sure, they're not included on Windows by default or (I believe) OS X but at least there's some level of trust.

pdkl95 12y ago
There service seemed... confusing. As you say, though, their cert is not included in win/osx, which makes it kind of useless re: client logins. (always trying to convert friends to a saner OS - with some success - but that's a slow process :/ )

ibotty 12y ago

hopefully dane fixes that.

dspillett 12y ago

> StartSSL won't give me a cert (they did previously, but want $$$ now) Do you have reference for that? I've been using their free certs for a few things for a while and a recent renewal was free. I'll be paying for one shortly, but that is only because I want a wildcard for one of my domains in order to save some faf. I suspect your problem is the "third level domain" thing: they would effectively need to have permission from the over of the next level up to sign a cert on your behalf for one of their names (or you would need your domain provider to take part in the validation process). > for those that can afford it - the rest of us doomed to plaintext or rejected as "self signed" That certainly isn't the intention of the security community, but until a method is found that allows certificates to be freely produced without the security risks involved with self-signed certs that is what we (well, those in the poverty trap) are stuck with. How StartSSL arrange their business model seems to be one solution, your current problem above not withstanding. If the depth of your free domain is the issue then perhaps the solution lies with the domain registrant taking the cost of a wildcard certificate (~$30/yr with startssl, ~$60/yr elsewhere) and so their subscribers can use it for SSL. They would have to proxy web requests to you though (with something like nginx in a reverse proxy configuration), so it would not be a zero admin option and would cost them in extra bandwidth requirements too unless they already host your content (rather than just responding to DNS requests for content hosted elsewhere), otherwise the only way you could use the cert is for you to know the private key which breaks the assurance model completely. Perhaps you could convince a provider of third level domains that taking these steps could give them with a competitive advantage over similar providers who do not.

igravious 12y ago
Slightly off-topic but, in your opinion, how does StartSSL compare to CAcert? I'm about to jump and would like to know where I'm landing.
- LeoPanthera 12y ago
  The CAcert root cert is trusted almost nowhere, so they are not comparable. StartSSL certs are trusted by almost all major OSs and browsers.

makomk 12y ago

StartSSL-issued free certificates don't work reliably for XMPP in my experience anyway - some clients insist that the CN must be set to the top-level domain name and StartSSL won't issue free certificates with that configuration. I wouldn't be surprised if some XMPP servers had the same issue too.

Zash 12y ago
Then those clients are broken and should get fixed.
mmastrac 12y ago
Are the StartSSL free certs limited to something.example.tld? I've been using the inexpensive company-validated ones ($120 for two years) with a wildcart cert personally and haven't had that issue, so I'm unfamiliar with their free offering.
- agwa 12y ago
  As of 2013, if you get a free cert for something.example.tld, it also includes a subjectAltName for example.tld (which is usually desirable if something is "www" but undesirable if it's something else).

zokier 12y ago

The best option for you currently would be to pool some money from friends/family to buy SSL cert collectively. It probably makes sense anyways to share the server instead of everyone hosting their own.