Hacker News Reader

Comment by larrymcp | Hacker News Reader

The author doesn't say why this is worrisome. He just says he's worried "that the PKI front-end (auth.startssl.com) is now hosted within a Chinese Antivirus Company, who uses a Chinese ISP for 2 months and that there hasn't been any news around".

The article could certainly use a bit more connecting-the-dots to show how he gets from "they're hosted in China" to "I won't use them anymore".

View on HN

I think the implication is that the Chinese government exerts a lot of control over the internet there, and are openly monitoring/intercepting internet traffic. As such, they shouldn't be considered a trusted authority for security related purposes.

Your concern is well placed but the linked post really missed the point. Signing authorities in X509 don't have access to private keys and they don't really need domain owner's input to sign a MITM cert.

Most software that uses TLS nowadays ships with a number of CA root certs sponsored by various nation states including China. On desktop they can be disabled but iOS drvices are out of luck (or perpetually compromised in a sense)

http://slashdot.org/story/266739

By default, StartSSL's wizard generates private keys for you. (Providing your own key is of course an option).

For the higher account levels, they also require uploaded scans/photos of sensitive ID documents like passports / drivers' licenses.

Yes, that's a problem. If a company starts to ask for this sort of information I will refuse unless there are no alternatives.

Trusting a CA to provide your private key is on another matter.

There are people who use StartSSL for paid certificates? I though the free certs were the only reason people put up with their craptacular website.

It used to be a pretty sweet deal, for $60 you could get unlimited multi-domain multi-wildcard certs. Most other CAs charged more than that for a single wildcard cert, and noone else seems to even offer multiple wildcard domains in a single cert.

Which was quite sensible, actually. Charge for the actual costly process of manually verifying ID, and then allow for unlimited free domain-validations to be issued to the corresponding ID (which is the machine-automatable part).

After searching the web and comparing the different price rates, I just found a lowest wildcard SSL at $42/yr. at https://www.ssl2buy.com. I hope that you would not find cheaper than this wildcard SSL. As they did not charge any extra beyond the price and helped me to secure my number of sub domains. Even the backend technical support was good enough.

I agree that's sneaky. I would never use that feature - it's an invitation to do MITM attacks later on.

When I first saw the form with this option on their website I thought "oh so that's why the Mossad is running this CA for free..."

I'm not convinced that is any more worrisome than the US situation as long as you don't trust them with your private keys. The US also monitors/intercepts internet traffic, except they do so (pre-Snowden anyway) secretly. They actually do a lot of things China gets accused of -- just think of the CISCO router "upgrade" facility.

Reply on news.ycombinator.com