Hacker News Reader

Comment by tptacek | Hacker News Reader

How many companies can survive a year without revenue? None I've ever worked at. Not only that, but their readmission after that year is uncertain! Mozilla gets to pick an auditor (raises hand! pick me!) that gets full access to their code. This is, I think, a higher bar than a new CA would have to clear.

StartCom is a popular CA. Distrusting previously-issued certificates would be extremely disruptive. Moreover, it would primarily punish StartCom's customers, and not WoSign, which as a business is primarily concerned with forward revenue.

You see this as leniency, but I see it as a powerful step forward. The browsers and CAs had previously been locked in a Mexican Standoff, with abusive CAs fully aware of the leverage their userbases offered them.

View on HN

Not only is it a year without revenue... I imagine this will devastate their revenues in future years as existing customers up for renewal during that time will likely permanently migrate to another CA.

It looks like Mozilla and Google have created a set of circumstances where the rational next step would be to wind down WoSign/Startcom and just start a new company.

Which would require creating new roots to be submitted to Mozilla's CA program, and passing the bar for inclusion of a new CA.

That's a multi-year process, unless they can get another CA to cross-sign their root, like LE did. I doubt other CAs will be willing to carry that level of risk given the reputation of WoSign/StartCom.

Or buy yet another CA and continue under their name?

There should be a 1-year plus ban on principals as well.

CAs need irreproachable reputations, anything less is absurd, like trusting your bank manager even though you know they have a gambling problem and owe money to Fat Tony. Having sympathy for their commercial corcerns is absurd.

The better solution would be to alert on all of their certs as being 'low trust'. A first step towards explicit trust belief, where reputations build slowly over time and can be severly damaged by bad behavior.

How is that solution better than effectively putting them out of business?

Because of the many certs already issued and in use for ecommerce (lovely 90's word!). This will encourage those users to move to new CAs without causing breakage. If we could move towards certs signed by multiple CAs that would be good too.

"how bad will it be for the company" is the wrong question to ask.

"what does the punishment need to be to prevent others from seeing it, and thinking it's a risk worth taking?" is a better one.

For me, I think it should be permanently revoked.

Yeah but the existing certs are still out there. While it's great that a company is being punished, this completely ignores the fact that we have no idea what they've signed, and short of laboriously checking the trust path of every single certificate you encounter there's no way to know if the cert you're looking at at any given moment came from them or not. And worse yet, the bigger problem is there's not a practical way to actually yank all of the certificates they signed that will work for arbitrary clients who don't know anything about this process to begin with and just look for a lock in the address bar, if that.

WoSign supposedly logged all certificates they issued to various Certificate Transparency log servers, so domain owners could check those records for any mis-issuance. There probably aren't too many organizations who check CT regularly right now, but it's better than nothing.

There's been some talk on mozilla.dev.security.policy about actively distrusting WoSign/StartCom-issued certificates for domains that have not been disclosed to CT as WoSign/StartCom subscribers (by baking the domain list into various browser binaries). That's probably the best option all around, though I'm not sure if it's going to happen (the report doesn't mention this).

Reply on news.ycombinator.com