Mozilla wants woeful WoSign certs off the list

Mozilla wants to kick Chinese certificate authority (CA) WoSign out of its trust program. As well as being worried about the certs issued by WoSign, Mozilla accuses the company of buying another CA, StartCom, without telling anyone. In this lengthy analysis posted to Google Docs, Mozilla says its certificate wonks have "... …

[asdf]

x.509 broken by design

How many fingers are in that dyke already?

[Warm Braw]

Re: x.509 broken by design

X.509 is not (now) restricted to a hierarchical PKI model, but that's essentially the only way it's ever been deployed since RFC2459 first made it the basis of the "Internet X.509 Public Key Infrastructure Certificate and CRL Profile" in 1999.

It's a tricky problem working out whether you should trust someone you don't know - it's hard enough working out whether to trust someone you do know - and all the schemes I've seen rely on an introduction through one or more "reputable" third parties (whether they're certificate authorities or mutual acquaintances). All these schemes fall down if the "reputable" party is no such thing. At least in principle you could regulate a commercial indentity-provider and have legal sanctions against them if they were negligent - the biggest problem seems to be that there is no effective regulation of this critical piece of infrastructure and no real interest in there being any.

[Doctor Syntax]

Re: x.509 broken by design

"the biggest problem seems to be that there is no effective regulation of this critical piece of infrastructure and no real interest in there being any."

No real interest except amongst the consumers, but, hey, who cares about them!

[Tomato42]

Re: x.509 broken by design

> No real interest except amongst the consumers,

ou contrair! the people that buy them are interested in them being as cheap as possible and if that means few bad apples, so be it

[Martin Summers]

Re: x.509 broken by design

"It's a tricky problem working out whether you should trust someone you don't know"

Where's that people rating site when you need it? :-)

[MrDamage]

Re: x.509 broken by design

> "How many fingers are in that dyke already?"

Fnar fnar!

[jamesb2147]

Judge, jury, and eulogy

"We require that all CAs whose certificates are distributed with our software products notify us when its policies and business practices change in regards to verification procedures for issuing certificates, when the ownership control of the CA’s certificate(s) changes, or when ownership control of the CA’s operations changes."

That's a clear violation. Mozilla claims they have evidence in the public record, confirmed by a lawyer, that WoSign 100% owns StartCom and has since November 2015. Reading through the list, Mozilla has been generous in leaving their certs intact thus far.

More importantly, the lack of audit findings are damning both for WoSign and Ernst & Young (E&Y has a lot more to lose, of course).

I used StartCom about 10 years ago on my first domain. They offered free, low security SSL certs that became trusted by most browsers, eventually, with clear instructions for creation, installation, and maintenance. Essentially, they did what Let's Encrypt is trying to do now, but on a smaller, more commercial scale.

RIP StartCom. You were kind to me in a world full of pay services.

[oldtaku]

Tiger Todger Can Fix That

Ah China. The air's poison, the water's poison, the pet food is poison, the milk is poison, the shirts are poison (and burn), the drywall is poison, the century eggs are poison, the booze is poison, even the CERTS are poison.

This seems like something only the ground up penis of an endangered species can fix.

[Anonymous Coward]

Re: Tiger Todger Can Fix That

It's strange then, when I go there for a long stay, my extremely rare autoimmune problem gets better; and as soon as I come back to the "clean and green" west, I get bad again.

But yeah, cheating and cutting corners is endemic in Chinese business; they cant even build a bridge without stealing half the foundation concrete and replacing it with bags of household rubbish.

[Version 1.0]

Re: Tiger Todger Can Fix That

It's strange then, when I go there for a long stay, my extremely rare autoimmune problem gets better; and as soon as I come back to the "clean and green" west, I get bad again.

Probably pinworms.

[Anonymous Coward]

Get in first

Get it done now, open firefox>preferences>advanced>certificates and delete the WoSign certs

[TonyHoyle]

Re: Get in first

And the startcom certs, since they're essentially the same company.

That's likely to have a bigger impact.

[Czrly]

Re: Get in first

Didn't work for me. They just reappeared in the list after I closed the dialogue and clicked "View Certificates..." a second time.

[juul]

How decides, whom I trust ?

I would bee much happier if I could choose which CA's I trust, instead of having Mozilla, Google, Microsoft, Opera etc. do it.

[Dan 55]

Re: How decides, whom I trust ?

You can, it's just very annoying thanks to the UI. Tools > Options > Advanced > Certificates > View Certificates > Authorities > Delete or Distrust. Only it's impossible to sort the list, order by distrusted authorities, etc...

There must be a better way... an add-on or something.

[tin 2]

Re: How decides, whom I trust ?

You totally can. I wish you luck with researching the backgrounds, ethics and business practices of all those companies on your own. Me I'll probably gratefully let Mozilla carry on doing it.

[Ian Thomas]

Re: How decides, whom I trust ?

Someone has to decide for everyone, because site owners need to know that you'll trust their certificate.

If you don't trust a CA then what are you personally going to do about it? All you can do is not use sites that use their certificate (which could be a big pain). If Mozilla don't trust a CA, then they basically put them out of business. That threat alone should encourage CA to be reputable.

[Alan J. Wylie]

What about the other browsers?

Unless Google, Apple and Microsoft follow, Mozilla stands to lose market share: users want things that "just work" and if Firefox starts giving error messages, they might move to an alternative.

Chris Siebenmann's blog

[TonyHoyle]

Re: What about the other browsers?

They probably will, if these allegations are proven.

[Anonymous Coward]

Corruption in random numbers?

At some point, everyone will understand that anyone selling a SSL cert that is 100% (*) accepted is related to a spook. That is the only way you can get in the game and everyone in the game is already a player.

[Alan J. Wylie]

Interesting messages from Tyro

First, an old announcement about problems with SHA-1:

http://www.newsagencyblog.com.au/2016/06/02/if-you-are-running-windows-xp/

and secondly a blog posting, now deleted, but still in Bing's cache: try this link to archive.org or search Bing for the text below

https://tyro.com/blog/merchant-security-is-tyros-priority/

Merchant security is Tyro’s priority

Sascha Hess

27/09/2016

To summarise: after a SHA-1 to SHA-2 upgrade, some merchants had obsolete Point of Sale systems that were unable to connect. Tyro "reached out in good faith to certificate authorities to provide a few months runway to resolve this big challenge".

[Alan J. Wylie]

Apple's response

https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/lWJ1zdUJPLI

In light of these findings, we are taking action to protect users in an upcoming security update. Apple products will no longer trust the WoSign CA Free SSL Certificate G2 intermediate CA.

[Alan J. Wylie]

WoSign has stopped issuing free certificates

https://twitter.com/rmhrisk/status/782838192944713728

https://buy.wosign.com/free/?lan=en

Sorry, due to some security consideration,

WoSign decide to close the free SSL certificate application temporarily. Sept. 29th 2016.