Comment by koolba | Hacker News Reader

Comment by koolba | Hacker News Reader

Parent Full thread

For those of you who don't read beyond the subject line, here's the meat:

> It seams that wosign has registered the domains letsencrypt.cn and letsencrypt.com.cn in 2014 after the public announce of Let's Encrypt.

And here's the whois record:

    $ whois letsencrypt.cn
    Domain Name: letsencrypt.cn
    ROID: 20141120s10001s72911711-cn
    Domain Status: clientTransferProhibited
    Registrant ID: k35-n2041486_00
    Registrant: 深圳市沃通电子商务服务有限公司
    Registrant Contact Email: dns@wosign.com
    Sponsoring Registrar: 厦门三五互联科技股份有限公司
    Name Server: ns3.dns-diy.com
    Name Server: ns4.dns-diy.com
    Registration Time: 2014-11-20 09:57:27
    Expiration Time: 2017-11-20 09:57:27
    DNSSEC: unsigned

Unless they registered those domains to "reserve" them for LetsEncrypt (haha right?), this is pretty blatantly deceptive, or at least they planned to be. Then again not exactly the worst thing they've done in the world of SSL.

> Unless they registered those domains to "reserve" them for LetsEncrypt (haha right?)

Which is exactly what WoSign say they did in that same comment thread after noticing that LetsEncrypt didn't register the Chinese domain names themselves.

They also offer to transfer them to LetsEncrypt at no cost.

Then I'm sure they have a copy of the email they sent to Let's Encrypt the day they registered it, letting know they were just doing them a favor...

This is so blatantly abusive that wosign and startcom needs to be pulled from all trusted root CA stores immediately. If their SSL cert clients' websites break, so be it. This is outright malicious behavior.

The internet engineering community would come down like a ton of bricks if somebody registered ripe.cn and decided to impersonate RIPE. Same principle.

They didn't impersonate letsencrypt so that doesn't apply.

It's true that they didn't impersonate letsencrypt, but they did:

1. Assign DNS records to these two domains and remove them after someone exposed these domains. https://groups.google.com/d/msg/mozilla.dev.security.policy/...; https://archive.fo/MQwMK; https://archive.fo/0HQZ7

2. Send marketing e-mails that exaggerate threats of using a "foreign CA", such as Let's Encrypt: https://groups.google.com/d/msg/mozilla.dev.security.policy/... (Well, "Percy" has always been bringing it up.)

While (2) has been something too old to keep bringing up, (1) certainly undermines some of Richard Wang's claim.

Reply on news.ycombinator.com