Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Security IT

StartSSL Suspends Services After Security Breach 54

Posted by timothy from the alliteration-above-averted dept.
An anonymous reader writes "StartSSL has suspended issuance of digital certificates and related services following a security breach on 15 June. A trademark of Eddy Nigg's StartCom, the StartSSL certificate authority is well known for offering free domain validated SSL certificates, but also sells organisation and extended validation certificates."
This discussion has been archived. No new comments can be posted.

StartSSL Suspends Services After Security Breach More

StartSSL Suspends Services After Security Breach

Comments Filter:

  • Mainstream SSL certificate issuers are hard enough to trust; ones too tight to even check the requester's identity properly doubly so.

    Not sure whether to blame the issuers for not really caring as long as they get their overpayment, browser manufacturers for their root acceptance policy, or customers for not caring as long as the little lock icon is there.

    • Say a hobbyist wants to run a blog, forum, or wiki, but doesn't want users' passwords and sessions to get snooped with tools such as Firesheep. Can anyone recommend a good CA for hobbyist web site administrators?
      • http://www.cacert.org/ [cacert.org]

        Or just issue self-signed certificates, and tell your users to verify the fingerprint manually.

        • Re: (Score:2)

          by tepples ( 727027 )

          http://www.cacert.org/

          Which major web browsers take CACert?

          Or just issue self-signed certificates, and tell your users to verify the fingerprint manually.

          Against what trusted source would they verify the fingerprint? Ideally, we'd be able to use a self-signed certificate and embed it in a DNS record, but that will have to wait until home ISPs get around to implementing DNSSEC on the recursive resolvers that they list in DHCP.

          • Just about any of them. Click on the fucking .pem file.

            • Click on the fucking .pem file.

              I have IE 8, Firefox 5, and Opera 10.something on this Windows XP machine. None of them appears to have any file whose name ends in ".pem". All the .pem files on this PC's hard drive are in copies of Python (the one in Blender, the one in OpenOffice.org, and a stand-alone installation of Python).

            • On my phone?

              • I installed it on mine. I'd say the onus of that is on the phone's manufacturer, given it's not a general purpose computing device.

                • Re: (Score:2)

                  by tepples ( 727027 )
                  Then how do I convince the major phone manufacturers to install a particular root certificate so that my site's users who use such phones can contribute using their phones without getting Firesheeped?

                  • Doesn't really matter. SSL provides two services: verifiability, and confidentiality. Not having the CA's certificate installed only prevents the verifiability part of this... and what you are worried about falls under confidentiality, which still works just fine.

                    • SSL provides two services: verifiability, and confidentiality. Not having the CA's certificate installed only prevents the verifiability part of this

                      There are SSL MITMs in the wild. The one publicized by Bugzilla [google.com] involved a wireless access point that routed all HTTPS requests through a proxy. Web browsers are right to show scary warnings when the verifiability service fails because people could be giving their passwords to such a MITM.

                    • You only need to verify once. If you are repeatedly asked on every visit, this is something you should report as a bug in said browser.

                      You'd only be vulnerable on the first visitation.

                    • You only need to verify once.

                      Once on each device (computer or Internet appliance) that you use. (I've never seen anyone carry around a repository of sites' self-signed certificates on a USB flash drive or microSD card.) And if one of those devices is behind a MITM proxy the first time you add the site's certificate on a given device, you're fastened with a screw.

                      If you are repeatedly asked on every visit, this is something you should report as a bug in said browser.

                      If by "report as a bug" you mean file a feature request to let people store their repositories of self-signed certificates in the "cloud", such a feature request would probably

          • Against what trusted source would they verify the fingerprint?

            Using the following two Firefox plugins gets you pretty effective certificate vouching:

            • Re: (Score:2)

              by tepples ( 727027 )
              But are they updated for Firefox 5? It took a while to get Perspectives updated for Firefox 4.

            • If you have to convince users to use an extra plugin, or reconfigure their OS to support your SSL certificate, then you might as well use a self-signed certificate in the first place.

              End users (unless they are security geeks) don't know what SSL certs are, and how to go about "verifying" them. StartSSL was nice in that it could issue certificates that Windows and OSX could trust without any extra intervention by the site visitor.

              • For those of us who understand certs these do the job. My comment is meant for them.

                For the average joe I think it should be possible to build a plugin that abstracts the information in a way that makes sense.

                • You missed the point.... the question further up the tree was

                  Say a hobbyist wants to run a blog, forum, or wiki, but doesn't want users' passwords and sessions to get snooped with tools such as Firesheep. Can anyone recommend a good CA for hobbyist web site administrators?

                  If you have to educate your site visitors about SSL certs, and then get them to reconfigure their browser, OS, or install a plugin.... then you've already failed. The fact is that if you want to run a basic site and use SSL to secure thing

                  • Diverged from the point, yes. Sorry.

                    Maybe in time we can get to where reputation systems like Perspectives are the norm that everyone uses. That would solve the problem you're referring to.

                    To get there, people who have a little technical understanding should try out what's currently available. I recommend you give Perspectives and Cert Patrol a try.

          • Comment removed based on user account deletion

            • You want one that works, it ain't free but it IS cheap and you get a free 30 day trial to give it a spin. Here you go Comodo Instant SSL. To get the free trial just pick the free SSL button on the upper left.

              Alternatively, just ask some Iranian script kiddie and you can get all the free Comodo certs you want.

        • Re: (Score:2)

          by cos(0) ( 455098 )

          Or just issue self-signed certificates, and tell your users to verify the fingerprint manually.

          Try making a site with more than two total users, then re-read what you just said. Of course, your site is so important and irreplaceable that your users will verify the fingerprint manually. To avoid the bootstrapping problem, maybe put your phone number into the certificate and they'll call you, read you the fingerprint, and you can confirm it for them. They won't mind at all.

      • Well, as TFA mentions, AffirmTrust [affirmtrust.com] apparently does this now, "coincidentally" starting on the day of the breach.

        Another commenter mentioned CACert [cacert.com], which is great except that I don't want my users to have to install a certificate or bypass a warning to use my site.

        • AffirmTrust apparently does this now

          Your verb tense confuses me. The web site [affirmtrust.com] claims that it's not yet available: "We are launching soon and will notify you when AffirmSecure SSL is available. Just fill out our form below and we will send you an email on the day we launch. We look forward to providing you with free ssl certificates very soon!" Nor does it even give an ETA.

      • There are still plenty of places that will send you a widely accepted cert for like $10. Just search for cheap SSL certificates.

    • Not sure whether to blame the issuers for not really caring as long as they get their overpayment, browser manufacturers for their root acceptance policy, or customers for not caring as long as the little lock icon is there.

      The first two are only a problem because of the last -- if people actually knew and cared about TLS, none of these shenanigans would have. CAs would be vastly more secure, they would check identities far more closely, and browser manufacturers would be more strict about which signing certificates they include.

    • browser manufacturers for their root acceptance policy

      And amidst al this, my Firefox installations trust these root authorities and their slipshod security, trust totally unencrypted connections, yet won't trust my self signed certificates on the same network.

      Que some security pedant arguing that authentication from third party shysters like these is more important than having an encrypted connection.

      • Re: (Score:2)

        by heypete ( 60671 )

        Que some security pedant arguing that authentication from third party shysters like these is more important than having an encrypted connection.

        Leaving aside the "shyster" bit, without some sort of third-party validation, how would you know that you've actually established a secure connection to the trusted party, rather than some MITM?

        • Que some security pedant arguing that authentication from third party shysters like these is more important than having an encrypted connection.

          Leaving aside the "shyster" bit, without some sort of third-party validation, how would you know that you've actually established a secure connection to the trusted party, rather than some MITM?

          When you use unencrypted http, you are subject to MITM with every single connection you do. Plus simple passive sniffing on top of it all. Is that any better?

          Here's a very real scenario. Some months back, you connected to some minor site via https and accepted their self-signed certificate. Today, you are at a Starbucks and want to look at that site again. You have two choices:

          1. Connect via unencrypted sniffable, MITM-vulnerable http
          2. Connect via encrypted unsniffable MITM-vulnerable https which will rais

  • RegisterUK article only one with info (Score:3, Informative)

    by Anonymous Coward on Thursday June 23, 2011 @02:35PM (#36544968)

    Register story from a couple of days ago the only site so far with any real info. StartSSL is still down and no info has been provided on when they will start back up. Their OpenID service is not functioning either.

    http://www.theregister.co.uk/2011/06/21/startssl_security_breach/

    • darn, just used up all my mode points.

      I noticed this a few days ago when I was trying to generate some new certs. I also noticed there was almost no news coverage on it. At least nothing bad happened.

  • Existing certificate holders not affected. (Score:5, Informative)

    by neiras ( 723124 ) on Thursday June 23, 2011 @02:41PM (#36545060)

    Before the FUD starts flying, here's the message on the StartSSL page [startssl.com].

    Due to an attack on our systems and a security breach that occurred at the 15th of June, issuance of digital certificates and related services have been temporarily suspended as a defensive measure. Our services will be gradually reinstated as the situation allows.

    Subscribers and holders of valid certificates are not affected in any form.

    Visitors to web sites and other parties relying on valid certificates are not affected.

    We apologize for the temporary inconvenience and thank you for your understanding.

    I've used their services for years now. Never had a problem, though their web application is truly awful - I've always wondered how fragile it might be. Hope they can pick themselves up and get back to business.

    • Re: (Score:2)

      by Necroman ( 61604 )

      I just started using their service a few months back and was rather amazed with how awful their web interface is. I'm almost willing to pay for a cert so I don't have to use it.

  • I created a certificate through them a while back, for testing something; I forget what. I had forgotten about them until I got an email on the 16th:

    This mail is intended for the person who owns a digital certificate issued by the StartSSLâ Certification Authority (http://www.startssl.com/).

    The client certificate for _______@gmail.com and serial number XXXXX (YYYYY) is about to expire within the next two weeks. Please log into the StartSSL Control Panel at https://www.startssl.com/?app=12 [startssl.com] and get a new certificate for this purpose. Failing to update your client certificate might result in the loss of your account.

    Should you have lost the client certificate which was previously issued to you, please register once again - login without the client certificate installed into your browser will not work in that case.

    -- Best Regards StartCom Ltd. StartSSLâ Certification Authority

    Not sure offhand whether my certificate is legitimately expiring (don't recall the details on it; it was for a one-shot test of something), or whether this is some sort of phishing attempt. The email was sent on 16 Jun at 5:34pm - after startssl went down.

    • Why would a phishing email include the correct URL?

    • Re: (Score:2)

      by dgatwood ( 11270 )

      Well, my actual website's SSL cert expires two weeks from today. They have not emailed me as of today. And StartSSL is down, and this new site isn't up yet. I'm certainly not looking forward to paying money to any of the dirtbag SSL providers I've dealt with in the past....

    • I got a similar email, and my certificate is due to expire on the date they said it would. It is for my personal exchange server running on a home adsl connection in my basement, and I use them rather than a self-signed certificate because it saves the hassle of having to install it on every web browser I check email from.

    • No, this is just the usual reminder they send out about 14 days before the cert times out, nothing spooky there. But those whith certs running out right now _will_ be affected by the mainenance as it is not possible to log in to the control panel (which you would do to prolong the cert)

  • Their new name is now, StopSSL. *puts on shades*

  • I had a feeling this was going to happen (Score:4, Informative)

    by rennerik ( 1256370 ) on Thursday June 23, 2011 @03:07PM (#36545464)

    I submitted a story about this about a week ago: http://slashdot.org/submission/1653760/Free-Certificate-Authority-StartCom-Taken-Offline [slashdot.org] and speculated on whether or not this was due to a security breach.

    I am a bit disappointed in StartCom, considering they probably knew about this for a while and failed to tell anyone the moment it became apparent.

    I am fearful about what, if any customer data, was compromised. When you submit info for validation, you have to submit scans of your ID -- a drivers license, passport etc -- as well as other personal information. If the crackers got a hold of that info, there could be a bastion of fraud being perpetrated without anyone realizing it until it is too late.

    Many bank accounts these days can be opened over the Internet simply with a scan of a photo ID and filling out a form. One can apply for loans using the same information without ever setting foot inside a bank. This is a bigger threat, IMO, than fraudulent certs being issued; this can be revoked and patched in a matter of days. Identity theft is never so easy to fix.

    • If you don't have a passport, you had to give them either a birth cert of SSN scan.

      (IE drivers license + birth Certificate)

      Though I have not received any e-mails about recreating certificates.

  • A new company called SmartSSL has suddenly started selling certificates and claims to be the worlds most secure vendor. ;-)

Slashdot Top Deals

Two can Live as Cheaply as One for Half as Long. -- Howard Kandel

Close