News for hackers. Stuff that matters.
Re:Why I stopped using StartSSL (Hint: it involves a Chinese... by josteink on Tuesday February 16, 2016 @04:14AM (#11108692)
> while using client certificates is secure and everything, it's also seriously user-hostile. I have to remember which computer and browser I used a year ago to sign up? Yeah, I know I should back up client certificates, but seriously who does that?

So you want a secure website, and you agree that SSL is needed for things to be secure.

But you're not willing to put in one inch of effort yourself to secure your own SSL keys. You can't even bother to back up the master key to your own certs, because it's too much work?

Cognitive dissonance much?

If you care about security, then do it properly. If you're going to do it half-assed, just don't bother at all. All you're doing then is contributing to security-theater, which is all the work and no real benefits.

Re:Why I stopped using StartSSL (Hint: it involves a Chinese... by mkj on Tuesday February 16, 2016 @07:56AM (#11109502)
Client certificate themselves aren't so bad, I use them for my personal sites. But they way startssl used them without accounting for bad browser support is a problem.

If you accidentally visit their page with the wrong browser (Safari or Chrome, I forget) when you need to renew an expiring client certificate - the browser doesn't download it properly, you can't ever request another one. Anyway, letsencrypt sorts that out.

Re:Why I stopped using StartSSL (Hint: it involves a Chinese... by ascorbic on Tuesday February 16, 2016 @04:29AM (#11108762)
So every other CA in the world is doing it half-assed? I'm not aware of any others that require client certs to access the site.
Re:Why I stopped using StartSSL (Hint: it involves a Chinese... by ascorbic on Tuesday February 16, 2016 @04:57AM (#11108869)
I should add that of course I back up private keys, but in 20 years of using the web, I've not encountered a single other site that uses client certificates for authentication. I know it's more common in enterprise situations. I'm supposed to have a workflow to backup my browser client certificates just for one site? It's not their fault that browsers mostly have poor UI for handling client certs, but it is their fault for requiring them. Let's not even get started on what happens when you get chain problems, or if the client cert expires, or any of the myriad other ways it can go wrong. Just use 2FA like every other secure site, and I'll store a secure password in LastPass.
Re:Why I stopped using StartSSL (Hint: it involves a Chinese... by josteink on Tuesday February 16, 2016 @05:44AM (#11109013)
> I should add that of course I back up private keys, but in 20 years of using the web, I've not encountered a single other site that uses client certificates for authentication.

I don't know what you have been doing the last 20 years on the web (and I'll assume it's more than just surfing facebook), but it's not entirely uncommon, and I've encountered it several places.

Symantec's CA uses it. My online bank used to do so too. I've seen VPNs using it. Iirc some IPv6 tunnel-providers also require you to authenticate using certificates before letting you set up new IPv6 subnets.

It may not be mainstream, but it's part of the standard. And it's much more secure than a regular username/password, for the same reason SSH keys are more secure than allowing username/password logins.

Re:Why I stopped using StartSSL (Hint: it involves a Chinese... by ascorbic on Tuesday February 16, 2016 @06:01AM (#11109082)
The fact I'm on Hacker News should probably give you an idea. I know it's relatively common on corporate intranets, but I don't use those. I can assure you that I've used lots of CAs, banking sites, VPN providers, registrars, hosting providers (and plenty of others) and made no specific effort to avoid them, and StartSSL is (almost) the only one I've found. I've remembered that the UK Government Gateway used to use them about 10 years ago, but they were optional. My point was that you referred to all other security as "half-assed" (and implied I was too), which would make almost all other sites half-assed. Now there are a lot of sites with half-assed security, but I'm not sure you could call all of these half-assed: https://twofactorauth.org/ http://www.dongleauth.info/
Re:Why I stopped using StartSSL (Hint: it involves a Chinese... by josteink on Tuesday February 16, 2016 @06:06AM (#11109103)
> My point was that you referred to all other security as "half-assed" (and implied I was too), which would make almost all other sites half-assed.

To be clear about that: My point about half-assed was your seeming unwillingness to back up client-certificates which gives full access to your real certificates and (in some cases) private certificate keys.

Unless on Windows (where StartSSL has its private keys marked non-exportable in the certificate store, sic), doing such a backup takes almost no effort. There's no excuse for going all the way through to get a cert and then not bothering backing up these client-certs too.

Re:Why I stopped using StartSSL (Hint: it involves a Chinese... by ascorbic on Tuesday February 16, 2016 @06:59AM (#11109280)
Even if it's easy (and it may be now - I haven't done it for a while), it's still a whole extra backup workflow, which I have to work out how to do for all different browsers, and if I'm on another machine work out how to import, and work out if it's possible on mobile, and oh look, my personal certificate has expired so I can't login to renew it so I need to create a new account to get a new certificate and email them to get the accounts merged...all for one site. Or

  ./letsencrypt-auto renew
Re:Why I stopped using StartSSL (Hint: it involves a Chinese... by josteink on Tuesday February 16, 2016 @08:58AM (#11109786)
Good for you, I guess. I've yet to have letsencrypt work a single one of my websites and I'll stick to StartSSL until it there's something better around.
Re:Why I stopped using StartSSL (Hint: it involves a Chinese... by lmm on Tuesday February 16, 2016 @06:51AM (#11109245)
If a CA is not at least allowing client certs (so that you can e.g. use a smartcard with a key for auth rather than a password) then yes they're doing it half-assed.

(Browser makers are quarter-assing their UX for using client certs, but that's a separate issue).