Hacker News Reader

Hacker News

Comment by baby | Hacker News Reader

Parent Full thread

baby

> StartCom hired PwC for doing a full webtrust audit.

Is PwC any good for real security audits?

> StartCom hired Cure53 as suggested by Mozilla

Does that mean the report will be public? That's what Cure53 tend to do.

> c.- StartCom acquired EJBCA PKI software from Primekey (CA, VA and TSA). There´s no in-house development for PKI

After acquisition it is now in-house...

> e.- StartCom has developed a new CMS system and website, using a new language, PHP, from scratch.

This sounds like they're in need of a real webapp audit

Another question: are there any real reasons why we don't have critical name constraints to countries' TLDs?

View on HN

> Is PwC any good for real security audits?

It depends on what you mean by "real security audits." If you want someone to audit your new crypto protocol, probably not. PwC is more about internal control / governance audits. They're making sure financial reporting is done correctly, segregation of duties are enforced within the organization, record retention policies are documented and enforced. Less technical, more organizational / meatspace. PwC is the sort of auditor that would find out that a company has a beneficial owner that's connected to a high ranking political figure in China... stuff like that. And I think they're pretty good at it.

I see. It looks like the security/crypto audit has gone to Cure53, which definitely looks like a serious consultancy.

  are there any real reasons why we don't have critical
  name constraints to countries' TLDs?

The reasoning I've heard is that .cn users' security requirements aren't any lower than .com users' security requirements. i.e. if startcom/Qihoo360 aren't good enough to issue .com, they're not good enough to issue .cn

Yeah, but reducing the number of CAs that are trusted for any given domain is likely positive.

I'm also curious as to how the Chinese government plays into all this. Do they have a track record of making trusted CAs misissue certificates?

> Do they have a track record of making trusted CAs misissue certificates?

Probably not. Any CA missisuing certs intentionally (whether by government coercion or not) probably wouldn't remain trusted for long. So if the Chinese government is doing something like that, the public is certainly not aware of it, else there wouldn't be any Chinese CAs left that are still trusted.

That's the beauty of the trust store. The PKI might be a fucked up solution to our trust problem on the internet, but it puts enough pressure against governments to throw them away.

I've heard that some countries' CA tend to misbehave more than others, that would help.

The Cure53 report is public. Their final statement is positive.

https://bugzilla.mozilla.org/attachment.cgi?id=8886970

That is not the cure53 report unfortunately. Still looking for full audit report.

will there be a full report?

I hope so. It would be in teresting to read.

It's a webtrust audit, not a security audit per se.

http://www.webtrust.org/licensed-webtrust-practitioners-inte...

can you explain the difference?

They are not checking if your systems are, say, vulnerable to a SQL injection attack. Take a look at

http://www.webtrust.org/homepage-documents/item54279.pdf

and say, a typical CPS

https://www.digicert.com/wp-content/uploads/2017/01/DigiCert...

They do an audit to check if all practices and procedures follow these guidelines.

Ah, a checklist audit.

> After acquisition it is now in-house...

I first parsed this differently, too, but I think they just bought some software for PKI services, not the software company.

Reply on news.ycombinator.com