mainSavannah Administration - Support: sr #106651, Savannah should use...

 
 

sr #106651: Savannah should use CAcert.org-signed SSL certificates

Submitter:  Reed Loden <reed>
Submitted:  Sun 22 Feb 2009 09:52:43 AM UTC
   
 
Category:  Savannah website Priority:  5 - Normal
Severity:  3 - Normal Status:  Done
Privacy:  Public Assigned to:  Beuc
Operating System:  None Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Wed 18 Mar 2009 09:04:06 AM UTC, comment #10: 


> Again, why can't you just use the certificates
> the FSF has already purchased?


Those certs were bought by mistake and will expire in a few months.
We believe in an alternate way to express trust, not based on a bootstrap group of opportunists, money, and unclear browser-inclusion rules - check the links.


> They are from a reputable CA and are accepted
> by all major browsers.


Ms windows is pre-installed in all major hardware products, this doesn't make it something we want to use.

"Reputable" CAs make mistakes, e.g. http://blog.startcom.org/?p=145


> We shouldn't be teaching users to ignore SSL
> error messages from their browsers just to access Savannah


This is wrong. The documentation tells to accept the CAcert certificate and none else. I didn't hear anybody complain when we used self-signed certs, which is worse, so please don't mix up Firefox' new error message and the use of CAcert.org.

> CAcert is [...]


I won't discuss any further until there's supported arguments.


And last, I'd appreciate your opening a discussion on the cacert.org mailing list where educated people can answer your worries, instead of spreading unverified claims to their users on their back.

Sylvain Beucler <Beuc>
Wed 18 Mar 2009 12:15:37 AM UTC, comment #9: 


> I think there was just a misunderstanding about CAcert.org, and
> there's no new argument in the discussion, so I'll close the
> request.


There is no misunderstanding on my part at all. Karl and I both are stating exactly what we mean. CAcert is insecure, and there are facts on both CAcert.org as well as other sites to prove it. I'm on vacation this week (and away from my main computer), so I don't have the time or resources to mention even more details, but I'll comment again next week with some info.

I will again request that you fix the summary of this SR, as well as reopen it pending an actual resolution.

Again, why can't you just use the certificates the FSF has already purchased? They are from a reputable CA and are accepted by all major browsers. We shouldn't be teaching users to ignore SSL error messages from their browsers just to access Savannah. Also, it hurts Savannah by forcing users to accept such certificates in order to log in.

Reed Loden <reed>
Tue 17 Mar 2009 08:42:38 PM UTC, comment #8: 

I think there was just a misunderstanding about CAcert.org, and there's no new argument in the discussion, so I'll close the request.

- Links -
For the audit status, check:
  http://wiki.cacert.org/wiki/AuditToDo
and also this nice one (more accessible):
  http://iang.org/papers/open_audit_lisa.html

Sylvain Beucler <Beuc>
Sat 28 Feb 2009 11:14:34 PM UTC, comment #7: 

Nick: we don't use MD5 since 2008 as far as I remember - and neither do CAcert.org:
$ gnutls-cli --print-cert savannah.gnu.org </dev/null >sv.pem
$ certtool -i < sv.pem | grep 'Signature Algo'
Signature Algorithm: RSA-SHA


An MD5 cert would produce a warnings in GnuTLS:
        Signature Algorithm: RSA-MD5
warning: signed using a broken signature algorithm that can be forged.

Sylvain Beucler <Beuc>
Fri 27 Feb 2009 02:08:27 AM UTC, comment #6: 

Does Savannah use MD5 for the signature? I recall seeing some documentation on how to verify the ssl certificate and now I do not see it. According to this article, md5 signatures are very bad and have been cracked. Negate Schneier's messages about how nobody cares about SSL; it would be better to worry about what is the best practice.

http://www.schneier.com/blog/archives/2008/12/forging_ssl_cer.html

-Deleted Account- <nicalvaro>
Wed 25 Feb 2009 07:22:29 PM UTC, comment #5: 

Pals, let's try to use supported arguments in this conversation.

- RMS, when asked in 2006, saw no issue in using CAcert.org while the website source code was proprietary. However, consistently with the Savannah Hackers decision that we made at that time, we used CAcert.org when the source code was eventually free, that is, in 2008.

- Point to places where this "lost keys" issue is detailed. {{{reference_needed}}}, in other words.

- I don't feel I'm exactly vehement - considering the other evangelists here :)

Sylvain Beucler <Beuc>
Wed 25 Feb 2009 01:56:51 AM UTC, comment #4: 

Sylvain, I'm afraid I now don't understand why you argue so vehemently that CAcert is better than anything else.  I thought the whole point was that CAcert's code was free.  But if savannah used CAcert when it was nonfree, then I don't get it.

I am not surprised rms did not care.  He has never argued that all code on all web sites should be free, or refused to deal with certain web sites (or certain browsers) just because they aren't free.  By the same token, he obviously doesn't care if equifax is used; that's who signed the cert for www.fsf.org.


Karl Berry <karl>
Site Administrator
Tue 24 Feb 2009 11:42:35 AM UTC, comment #3: 

Why was the summary changed? "Savannah should use CAcert.org-signed SSL certificates" is not what I filed at all. Please change it back to what it was since I apparently can't change the summary myself.

This is not FUD. FUD is for things that don't have any facts backing them up at all. CAcert.org itself has shown that these problems do indeed exist. You can't honestly just ignore this.

On a completely separate issue, is using a CA root not in most browsers really the best thing for Savannah? It just adds yet another hoop people have to jump through in order to get to free software and help out the community. There are other CAs (such as StartSSL - www.startssl.com) that offer Web of Trust things similar to CAcert.org but have wider acceptance in the browser world, if that's what you find appealing.

Reed Loden <reed>
Tue 24 Feb 2009 07:11:28 AM UTC, comment #2: 

This is an old issue that we already discussed, and you don't bring anything new, beside more FUD.

RMS doesn't have a problem with CAcert, he was even ok with using it when their source code license was still proprietary.
(E1EyhTh-00067l-QX@fencepost.gnu.org - savannah-hackers-private)

Sylvain Beucler <Beuc>
Mon 23 Feb 2009 12:08:44 AM UTC, comment #1: 

Personally, FWIW, I agree with Reed.  I'm not overly impressed by "auditing", having been on the other end of ssl auditing in various contexts at various times and it always seemed like a meaningless exercise in paperwork -- but losing private keys is inexcusable.

It's not a money issue.  John already bought the cert.

Of course I agree that it would be better, in principle, to use certificates from an organization with freedom-respecting policies.  But when the only (right?) such org is so slipshod, it seems like the lesser evil to me to use keys from the same org as gnu.org and fsf.org.  Obviously rms does not insist on cacert.org, although perhaps he's never been consulted; and perhaps we should ask him.

Sylvain?



Karl Berry <karl>
Site Administrator
Sun 22 Feb 2009 09:52:43 AM UTC, original submission:  

Savannah (both .gnu.org and .nongnu.org) are currently using SSL certificates signed by CAcert.org. Karl mailed savannah-hackers-public@ on this issue last October after he saw my initial mail to bug-gnuzilla@ concerning IceCat's inclusion of the CAcert.org CA root. Frankly, it's scary that Savannah is using a certificate from a root that doesn't have full knowledge of where its private key has been over the last several years. I believe they've regenerated a new private key lately, but that still doesn't excuse them for other practices and issues they've had. We shouldn't be trusting them for something as important as SSL just because they tell us to. Once they've had a real third-party audit, then we can talk, but until then, Savannah should be using an SSL certificate signed by an audited CA root.

My original mail bug-gnuzilla@ and subsequent thread - http://lists.gnu.org/archive/html/bug-gnuzilla/2008-10/msg00049.html

Karl's mail to savannah-hackers-public@ and subsequent thread - http://lists.gnu.org/archive/html/savannah-hackers-public/2008-10/msg00006.html

I think this is a very important issue that should be taken seriously. We should care about the security of Savannah and how it affects users. We should not be helping to coax users into ignoring valid SSL certificate error pages. If this is purely a money issue, I'm sure the FSF has enough money to help buy a valid SSL certificate for Savannah.

I'll be happy to entertain comments/questions/etc. about this, so let me know what's on your mind.

Reed Loden <reed>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by nicalvaro (Posted a comment)
  • -email is unavailable- added by Beuc (Posted a comment)
  • -email is unavailable- added by karl (Posted a comment)
  • -email is unavailable- added by reed (Submitted the item)
  • -email is unavailable- added by reed
  • -email is unavailable- added by reed
  • -email is unavailable- added by reed
  • -email is unavailable- added by reed
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 8 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2009-03-17 Beuc StatusNone Done
        Assigned toNone Beuc
        Open/ClosedOpen Closed
    2009-02-24 Beuc SummarySavannah should not use CAcert.org-signed SSL certificates Savannah should use CAcert.org-signed SSL certificates
    2009-02-22 reed Carbon-Copy- Added r33d
        Carbon-Copy- Added karl
        Carbon-Copy- Added johnsu01
        Carbon-Copy- Added beuc

    Back to the top

    Powered by Savane 3.13-cf05.
    Corresponding source code