Hacker News Reader

Comment by keketi | Hacker News Reader

A vulnerability of this level is inexcusable. StartSSL ought to be removed from all major browsers.

Right now, StartSSL needs to do a quick search on their database to see which certs had email sent to a domain other than the one for which the cert applies. All such certs should be revoked immediately, and the owners of the domains involved notified of the breach.

Also, did they check properly for TLD and subdomain issues? If I have "me.blogspot.com", can I get a cert for "blogspot.com"? (What's a TLD today? It's complicated. See "https://publicsuffix.org/")

StartSSL only allows validation for top level domains. So you can't get a cert for me.blogspot.com unless you own blogspot.com.

I think you entirely missed his point.

What about blogspot.co.uk? Do you need to own that, or co.uk to get a cert?

What counts as a "top level domain" is, as Animats said, complicated.

Oh ok. I can't attest to how this is handled because I have never attempted to get a cert for a domain like this.

You would soon be left without any CAs. [1] People are pretty stupid when it comes to security, and this includes people working for CAs. There have been cases where the CA private key is publicly accessible to the internet without any password. [2]

[1] Yes, plenty of smart people have been advocating moving away from the current CA system. It's fundamentally broken.

[2] A great talk by moxie, filled with horror examples of CAs. The private key example is at 19:20. https://www.youtube.com/watch?v=Z7Wl2FW2TcA

Certificate Transparency with mandatory SCT delivery (as with EV certificates) will largely solve¹ the issue of fraudulent or compromised CAs.

¹ As long as you're monitoring CT log servers for anything involving domains you own.

Obligatory reference to my CT monitoring service:

https://ctadvisor.lolware.net/

I agree. What certificates have been issued until now fraudulently like this? Does SartSSL submit certificates to Certificate Transparency? And if it does, who knows if there is a bug in that code too, and certs have not been submitted?

Mozilla, Google, Apple and Microsoft should remove this CA ASAP. If it breaks some sites, even better. Maybe it will make some noise and fix all this CA bullshit for good.

IMHO this could be handled more safely: suspend or remove the acceptation of any StartSSL certificates issued after a given date. This should give them some more accountability.

Agreed. The more I hear about StartSSL the more I want to run away.

Reply on news.ycombinator.com