On 12/27/2008 10:36 PM, Florian Weimer:
As a downstream distributor of Mozilla code,
StartCom is also a downstream distributor of Mozilla code...
I'd hate to roll out updates (especially security updates)
...which happens every two month anyway...
just because CAs start to play games with each other.
I really hope that nobody sincerely believes that this is a game. However any other party - and not only competing CAs - are invited to verify the the implementations of the StartCom CA at any time, heck I'd even thank you for finding a bug: http://www.startssl.com/
(For every wrongfully issued certificate I'll return to you ten times the amount you paid for it ;-) )
This is not about "security proper". You're trying to pull us into a PR attack on one of your competitors, thereby willingly reducing confidence in ecommerce. (I'm exaggerating a bit, of course.)
Exactly the opposite is true. If at all, I'm trying to encourage responsible competition on *equal* footing without compromising the security of the relying parties. It needs just *one* CA to devalue the collective work of browser vendors, certification authorities and cryptography specialist. Only one! Unfortunately some CAs take their responsibilities less serious than others - which in turn gives them a competitive advantage. Besides that, I'm known to work towards improving the practices of public certification authorities in order to provide better security on the Internet.
If users edit /etc/hosts to complete the attack, it's their fault.
Nobody will do that and this is not how those attacks work. That's only to easily demonstrate it.
Even if you've got the certificate, you need to attack IP routing or DNS.
This is one way, there are others [1].
If you can do that, chances are that you can mount this attack against one of the domain-validating RAs, and still receive a certificate.
CAs (should) have controls in place to prevent that from happening. But since you mentioned RAs, than yes, it's fairly bad that an RA hosted at a hosting provider should perform those validations. This is exactly why we think that this functionally should not be outsourced but performed at the CA.
So the browser PKI is currently irrelevant for practical purposes (beyond CA revenues and giving users a warm, fuzzy feeling), even if everybody follows established RA procedures.
This however is unrelated FUD! [1] https://bugzilla.mozilla.org/show_bug.cgi?id=460374 -- Regards Signer: Eddy Nigg, StartCom Ltd. Jabber: start...@startcom.org Blog: https://blog.startcom.org _______________________________________________ dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
