XSF Discussion - 2014-04-08

Sorry guys, my bad. Prosody didn't come back up after upgrading to the new openssl.

StartSSL is probably going to make heaps of money from all the revocation requests they will get.

It seems there is only two XEPs remaining here: http://xmpp.org/xmpp-protocols/xmpp-extensions/

That's not many.

It's only the index that's broken. The actual XEPs seem to work just fine.

Yeah.

That;s a bit of a relief. Still bad, but not as bad as it could be.

Who generates the xeplist?

It was regenerated yesterday evening at 21:19 UTC.

Matt was doing it last night.

He and I spent quite some time trying to work out what the dependencies of Tobias's script was, and getting it to work.

Ah. There might be a slight issue still then.

blerg

I think on international Internet Is Broken day, probably not our biggest concern.

How are we all doing with "free" certificates today?

Very sucky, thank you very much.

Raspbian doesn't have an update for openssl yet.

They must run their buildbots on RPis.

Kev: right.

Rebooting perseus, see you at the other side of the reboot.

I guess the installed version of Prosody on xmpp.org doesn't let us know we're kicked out of the MUC after all.

.

Ah, goodie.

AMusing thing: RapidSSL refuse emails for revocation requests; they have to be faxes for security.

SO you send your fax using a free online service via email.

intosi: MattJ promised to fix it. I suppose it will be on a Monday

Ge0rG: ta

this whole CA thing is just stupid. So broken. You fix revocations, then break it again by needing to use faxes… Bring on DNSSEC!

sorry - grumpy mood.

Simon: I think we all are a bit grumpy. The people with more than a few StartSSL certs even more so.

I think pretty well any sysadmin or devops is in a shitty mood today.

Well, that was the software side of all ik.nu-related machines.

It's hard to comprehend the scale of the heartbeat issue! Just effing mindblowing!.

Yup. Especially with PHBs who fail to understand the issue, and won't sign off the expenses for key revocations. A friend of mine happens to have this issue.

Ge0rG, intosi: What did I promise to fix?

It's so nasty. Not as if you can even switch CA to avoid the bait-and-switch.

MattJ, Everything.

Was afraid of that

dwd: indeed.

MattJ: xeplist only has two items.

anyone done a startssl revocation dance yet?

MattJ: you wanted to fix heartbeat.

My comment last night was about MUC/s2s on server reboots :)

MattJ: it was worth a try ;)

mattj: it seems you're leaking all your precious server code in hearbeat!

err... bleed

Simon, I haven't yet. But they will be rising fast on the list of vendors to be dropped in a heartbeat if it turns out that they will insist on me paying for revocation of all my certs… That's a lot of money that would've bought me certs with vendors that do have a sane revocation policy. It's not like you usually revoke them because you thought it would be the fun thing to do today.

Heart Bleed Why do you miss, when my baby kisses me?

Turns out there's loads of songs I never knew about called "Heartbeat". You could build a whole playlist.

intosi: It's easy to bitch about StartSSL. They have also done more than any other CA to get people to start using certs by making the basic certs free.

Oh, this fills me with confidence in StartSSL's knowledge and understanding of security: 72.) I made a mistake, can I get my certificate revoked? Revocations carry a handling fee of currently US$ 24.90. Class 1 subscribers may use a different sub domain in order to create additional certificates without the need to revoke a previously created certificate. Alternatively it's possible to upgrade to Class 2 level which allows to create the same set of certificates once again (besides all the other benefits), because different levels are issued by different issuers, making revocation unnecessary.

Private key compromised? Oh, just get a new certificate, then it's all OK.

yeah, it sucks.

I just mailed them (on a personal title) asking them how they would envision handling this.

Also note that, to my amazement, it's not just free certs they charge for - it's anything below EV.

Yeah.

If someone has been gathering private keys using this exploit, StartSSL customers are a nice target for identity spoofing.

If you claim it was spoofed, they'll revoke it for free, and ban you for life.

So a double win.

Yup.

xnyphs: do you plan on adding any checks for old certs / compromised certs to xmpp.net?

Simon: Define "compromised"?

Simon, You mean running status checks on them?

Certs past their notAfter date (on the moment of testing) are given an F.

anything older than the heartbeat announcement?

It doesn't check CRL/OCSP yet.

I noticed a libnss update whizz past on my workstation - am I just being behind, or was that affected?

Strongest would be 'potentially compromised'

You cannot claim the certs are compromised at all.

intosi: you have a point

dwd, http://changelogs.ubuntu.com/changelogs/pool/main/n/nss/nss_3.15.4-1ubuntu7/changelog

http://matthewwild.co.uk/uploads/dsas.png :'(

Oh, different problem.

intosi, seems someone in prosody@ got an, erm, negative reply from StartSSL

Negative in what sense?

"We will kill your account", or "pay us, we will revoke"?

intosi, The quote was "fuck you stupid", but I'm hoping that's paraphrasing.

Ehm, ouch.

Would be quite unprofessional if it wasn't.

are cert revocations still handled as a massive file that clients download? or is there some kind of querying standard?

Best answer: both

Simon, CRLs - signed lists - can be downloaded, and there's also OCSP for querying. In addition, servers can provide a recent OCSP response themselves, via OCSP Stapling, a TLS extension.

I shouldn't have had that last cup of coffee.

is anybody (read: a client implementation) actually using CRLs or OCSP?

Ge0rG, Swift may well be. But the TLS implementations don't tend to do this for you - NSS might do, but OpenSSL certainly won;t.

Ge0rG: If you enable it system-wide on OSX, then Adium does.

xnyhps - how does one enable it system wide on OSX?

Simon: Open "Keychain Access" -> Preferences -> tab "Certificates"

xnyhps, This isn't on by default?

It's "Best effort"

I don't remember what the defaults are, but I'm guessing no.

thanks.

Err, best attempt.

defaults to "best effort"

Ah, so it works, except when you need it to work. ;)

Yes, because strict checking would lead to a lessened end-user experience, probably ;)

intosi: isn't that true of all security measures?

Usually.

Ge0rG, Failing to do security right does also have a detrimental effect on the user experience, too. :-)

dwd: counter-example: cryptocat

dwd: like leaving your door unlocked. In normal use it's more convenient, until someone empties your home :)

Right, leaving your home unlocked means you can get in and out quickly and easily, but may hamper later attempts to watch the telly you no longer have.

http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=4817504d069b4c5082161b02a22116ad75f822b1 - Robin Seggelmann broke the Internet. And he also coauthored SCTP-DTLS

anyone know of a hosted XMPP service that lets you upload your cert+key?

ge0rg: ah, it's not ekr who is accused this time?

Friend of mine just pointed out it's not just private keys that could be leaked.

Of course

dwd: user data as well

Right, passwords etc.

dwd: pretty much anything in memory of the process, right?

for https also cookies, csrf token etc

This is what I posted to the Prosody list last night: https://groups.google.com/d/topic/prosody-users/LvbwWkUOGGU/discussion

intosi: And either process.

Kev, Oh, if a server requests heartbeats of a client?

Yes, it's possible

I was going to say in XMPP that's not too exciting, because the server generally knows everything the client knows

But not in the case of OTR...

Nor in the case of certificate authentication.

Or SRP, or SCRAM.

True

It appears that once you think you know the magnitude of the impact of this issue, you're not thinking big enough.

basically all data stored in the client or server process is screwed.

Also on the topic of security issues: http://thread.gmane.org/gmane.comp.security.oss.general/12514/focus=12523

Ah, CVE politics.

the bitcoin client is also linked against libssl. sounds like major emoney movement

No TLS there though, surely?

DTLS perhaps

or hashes and stuff

https://twitter.com/warrenguy/status/453510021930680320 It gets better.

at least one less of the horrible things: https://twitter.com/agl__/status/453472368589942785

Paraphrasing StartCom: "fuck you"

More detailed:

It's upon the subscriber to take appropriate action since the certificate authority can't enforce which software to use. The terms of service and related fees will not change due to that. See also the Subscriber Obligations at https://www.startssl.com/policy.pdf in particular:    • Never share private keys with any third party and use    adequate protection and best security practices to secure    private keys in order prevent losses and compromises thereof.    • Notify StartCom immediately in case of a private key    compromise and request revocation of the affected    certificate(s). Regards   Signer: Nikolay Duhman, CVO StartCom Ltd. <http://www.startcom.org/> E-Mail: nikolayd@startcom.org Phone: +972-57-631-56-27

I believe StartCom fails to see the scale of this issue.

intosi: yeah, they fail to see it for the many dollar signs in their eyes

intosi: is there a source on that paste?

Well, StartCom's model is free certs and paid for revokations if something goes wrong.

Kev: sensible if something goes wrong due to admin fail.

I wish I could make dumb people pay more for my time.

Ge0rG: what do you mean? This is the answer I got from StartCom when I asked about this issue.

intosi: I mean something like a pastebin URL I could submit to HN for some easy karma points :P

Ah. http://pastebin.com/B0UnY00p

thanks very much :)

FWIW, I don't see that this is worth anger at StartCom. The model was clear up front.

And the openssl vulnerability was hardly their fault.

While true, this might hurt the trust in StartCom. This is not an admin-error either.

In fact, the desire to have better security is one of the reasons many sites upgraded to openssl 1.0.1 in the first place.

it might be good publicity for startcom to open a window of maybe 1 month for free revocations

I will most certainly reconsider my plans to get a Class 2 certification with them. I was about to do that.

Kev: totally agree. Startcom is very clear that their basic certs are free and that additional services are payed for.

StartCom is adding a free angle to the whole CA extortion business.

I also like it how they provide an easy way to generate the private keys on their servers.

yes - that took me by surprise too.

On my paranoid IT-companies-run-by-Mossad list they range right before ICQ

usability WTF

Simon, why not?

expensive.

ah..k

Can't believe we're still putzing around with CAs.

or with TLS

(when IPSEC could solve a lot of this for us)

Bring back double-rot-13

there is even a dedicated opcode on most CPU archs for double-rot13... on x86 it is 0x90

one opcode up from the /dev/null acceleration unit?

intosi, What amazes me is that StartCom charge for revocation on Class 2. I'd not realised that before.

Neither did I until now.

Assumptions, and mothers of something I guess.

In fairness, I only knew about the revocation charges because I'd stumbled on it before. I disagree that it was "clear up front", I don't think you're warned when you're getting the thing.

You're not.

OK. I assumed it was clear, because you'd warned me.

You only find out about it if you read the FAQ, which is usually when you want to revoke.

(Which is why I didn't use them in the end)

(That and I felt more trust towards other CAs)

It's probably buried in the small print somewhere.

hi

I've only seen it in the FAQ, under "I made a mistake, can I get my certificate revoked?"

There is something in 4.9.1 of the policy.

"Revocations of certificates may carry a handling fee"

OK. That's considerably less obvious than I'd assumed.

Quite.

That footnote only applies to "The subscriber makes a request for revocation".

"The subscriber’s key is suspected to be compromised;" doesn't have a (*)

intosi: I did know about this. They have to make money somehow, I suppose.

intosi: I wonder if they make an exception this time around, though

Sure. And for admin-fuckups, I agree.

ralphm: I contacted them, and they said no.

intosi: I am guessing they will back down on this later today

ralphm, Why? They'll make more money today than they'll have made the rest of the year.

What dwd said.

It might lose them a few customers, but those will be mostly just the free-loaders.

dwd: depends. it might result in a PR disaster

And perhaps some Class 2 customers who only just found out they are charged for revocation as well.

intosi, Except you can't just walk away if you understand and care about security, so they'll pay the fee anyway.

Yup.

someone suggested their CA cert should be revoked instead :-)

I'd love to see the handling fee on that.

7am. I suppose I should get tonwork early today

-n

Have some bacon first.

Last hotel I stayed at had unlimited free bacon thanks to my status.

As far as I could tell, despite some efforts on my behalf to find one, there was no AUP either.

This hotel is pretty good *except* for breakfast. I never seen things so minimal.

ralphm, US business hotel?

They might charge you a revocation fee should you decide not to eat all your bacon.

dwd: no. I assume no chef and no dishwasher.

(or if the vendor of your utensils found out it compromised the bacon)

dwd: the breakfast at Aloft is Royal, in comparision

Golly.

intosi: the more retweets, the better, maybe

ralphm, What, really? That's really almost travelodgian.

dwd: plastic ware and no cheese or meats, no eggs, no whole fruits, dry croissants

They do have a waffel maker, oddly enough

intosi, any news on wiki.xmpp.org?

Tobias: nothing apart from "works if you allow your browser to remember the cookie for 180 days"

how do i tell chrome to allow that :)

Well, see the nifty checkbox on the login page?

Check that when logging in.

ahh :)

yup..that works...thanks :)

Still need to fix the issue though.

But having a workaround is good.

BTW, Yahoo is apparently leaking passwords via Heartbleed on login.

Yep.

I thought I pasted that in here a while back.

Oh, quite possibly.

dwd, my favourite is the comments on the Ars Technica article... they posted it while their site was still vulnerable, and now users are posting comments on the article as each other using dumped session cookies

we need to regenerate our XMPP certificates ? https://xmpp.net/ the certificates are still valid for my server

edhelas, they may have been compromised though

i.e. it may have been possible that someone downloaded your key file

yup

does anyone know if gtalk.com can pass IQ messages?

or am I being hit by some kind of rate limiting?

seems possible: https://developers.google.com/cloud-print/docs/rawxmpp

Simon: depends. Since May, many things are broken in this respect

thanks ralphm.

Like that if the recipient has enabled hangouts, you might not even get iq responses

On reddit, somebody claims that OpenSSL.org was vulnerable two hours ago.

That's… odd. It's mostly down for me.

Ah, no, it's back again.

And filippo.io agrees.

http://filippo.io/Heartbleed/#openssl.org

intosi, I'm hearing that test is not reliable - it can give false positives.

I recommend using http://possible.lv/tools/hb/

that test does not retest already tetsted domains

Ge0rG, Ah, gotcha.

not sure if the caching is browser- or server-side

i wonder how fast banks are with their patching

I've seen suggestions that some banks have been caught out.

I'm avoiding logging into anything crucial today

looks like my bank is safe.

dwd, indeed

intosi, Lloyd: Ta for the re-tweet. Bit cheeky. I wonder if they'll reply.

dwd: given that they are based in Israel, probably not soon

True, they're probably into their evening now.

The Ars Technica article's comments have a severe misunderstanding of PFS. Sadly, I think you could get at the DH parameters on the server, and that'd make EDH protected sessions pretty weak, wouldn't it?

dwd: I'd hope the server securely erases the EDH private key as soon as the handshake is done.

xnyhps: you presume much

Securely erasing things costs cycles, while a simple free() is much cheaper.

Guess which of the two many developers will choose?

I got far enough into the OpenSSL code to see that DH_free is doing something called "cleanse". But then I gave up.

It doesn't just cost cycles, it's hard bordering on impossible, depending on platform.

the other problem with securely erasing memory is: compilers. optimizing compilers. compilers optimizing away your write-before-free!

That's what I alluded to with 'hard'.

oh, you might as well have referenced managed languages with immutable data types, which are impossible to clean up.

That was the 'impossible' bit :)

nevermind virtualized services

And what about storage on SSD?

Well, any virtual memory.

intosi: any memory in a modern computer is virtual.

I've seen a couple of people saying that StartSSL have waived revocation fees now

Maybe they're seeing the light

MattJ: wow

yeah

really?

probably for today only, *IF* it's true

their servers are probably overloaded

intosi might appreciate a highlight, then.

Just seen someone over in prosody@ say they've had an "Exceptionally revoked without fee" from them.

dwd: maybe someone just screwed up

that said, how well do browsers even check revocation?

ralphm, Looked into this. Most pass-on-fail. Chromium and Chrome both seemed to be set to not check by default.

splendid

not checking is FAST

By "pass-on-fail", I mean if the OCSP server is down they'll just silently pass.

right

[21:16:17] tribut: hah. for a second cert i just recieved a request for a paypal transfer. so not always free it seems. @ dwd, ben

Meanwhile: https://twitter.com/startssl/status/453631038883758080

woah

That's not even trying to be nice

i really dont understand the mixed messages from startssl. they keep saying 'no' to waiving fees, and yet people say they did get waived fees

Lance: right. I am thinking that some of their support people have been slightly more friendly than others