Root Access - 2014-01-02 (page 3 of 3)

« first day (1245 days earlier) ← previous day next day → last day (3777 days later) »

11:00 PM

I asked Comodo:

> Hello,

I don't understand the statement: "In order to obtain a Code Signing certificate the admin email address on the account must be someone@somedomain.com, where someone@somedomain.com is registered to the organization on the certificate."

I did not apply to get a domain SSL certificate. I am an individual looking to sign some executables. The Comodo Strategic Partner through whom I submitted my order did not say anything about having to own a domain.

When I submitted the order with K Software, I used a gmail address. Since I do not own gmail.com, does that mean that I am unable to …

Comodo replied:

> Dear Sean,

Thank you for contacting us.

For Code Signing certificate we will validate your domain which is associated with your email address [someone@somedomain.com]. So please provide which is associated with your email address.

So that we can validate and issue the certificate as soon as possible.

Please bear with us.

did they even read my question?

Oliver Salzburg

:D

Yeah, they read: ... email address .... domain name .... Okay, got it! Pull up this automated response!

and seriously, shame on K Software for not mentioning the word "domain" anywhere on their website or FAQ or forum

Oliver Salzburg

I got a Comodo code signing certificate once though and I used an email address within a domain I had control over

I have half a mind to just cancel the fucking order

that rubs me the wrong way

they are adding on requirements after I placed my order

things they didn't mention up front

that seems very, very untrustworthy to me

Oliver Salzburg

I'm pretty sure your assumption in paragraph 3 is correct

I got mine through tucows, they offer good rates

At least at the time

11:04 PM

@allquixotic I see you are trying to get a certificated with Comodo... you should totally drop that and use jQuery ;)

@OliverSalzburg at this point, I can't even bring myself to care about price. I'd pay any rate whatsoever just to avoid having to get something notarized in person, because I've never done anything like that, and I really don't have the time and money to pay some lawyer to do it for me

Oliver Salzburg

@allquixotic I think, as you already proposed yourself, it is necessary to be able to tie your request to a valid domain with a verifiable WHOIS record

It all comes down to being able to tie the certificate to a real world entity

it's absolutely ridiculous that you can get a wildcard SSL cert without having anything notarized, but God forbid you want to sign code, and they want to be able to stick a scope up your ass and verify on a cellular level that you are who you say you are

Oliver Salzburg

@allquixotic Well, it's not like they are for *.com :P

and what's worse, I already sent them several extremely sensitive documents, because K Software said I could initiate the request myself once I placed my order by sending the required documents to docs@comodo.com

which I did

11:07 PM

@allquixotic That reads a lot like Indian English...

so they have all my personal information, enough to basically steal my identity, and I have nothing

@OliverSalzburg the far more annoying thing is that I have privacy enabled on my domain, so it doesn't even show up on WHOIS as owned by me; I'm pretty sure I'd receive a ton more spam if I didn't do that

so privacy on a WHOIS record is only useful if you never want to get any sort of certificates. just great.

@allquixotic I keep one domain with whoisguard and one without :P

the one without is for shit like this

really, what were they thinking when they designed these systems?

Also, we just go to the local post office when we want a notary...

and why do you have to submit sensitive documents by e-mail? it's not exactly the most secure method of communication in the world, especially without encryption, which of course they don't support

Oliver Salzburg

11:09 PM

@allquixotic What "usually" happens is that they send a confirmation email to the zone admin or any other autorative email that appears in the record

wait, no, that's a different thing

bleh

@Bob I don't even know if our post offices would have a notary, and if they did, they'd probably only know how to do paperwork for signing loans for houses, since that's pretty much the most common thing

@allquixotic yea, I got it mixed up with a different proof of identity

oh well... guess I just have to hope and pray that the Office add-in security settings at work aren't retarded enough to require me to have a valid cert... I'm probably going to self-sign the add-in with a self-created CA and see if I can't import my custom CA into the system during install

I'll have my $176 back asap K Software, Mr. "money-back guarantee"

and if not I'm filing a lawsuit for it

Oliver Salzburg

@allquixotic You could always just use an email account on one of your own domains

11:13 PM

@OliverSalzburg true, but I still have to cancel the current order either way, because when I placed the order, I put my gmail as the admin contact

and I doubt they'll let me change it because oh, they don't trust me to say what I want it to be! (eyeroll)

We can't use the post office anymore for that kind of thing... Canada Post is eliminating thousands of jobs and closing a bunch of offices

these people apparently haven't heard of https and web applications

Oliver Salzburg

1 year cert at tucows is $75.00 btw

I'll issue you a certificate! It's not worth anything, but I can make you one!

@OliverSalzburg do you have to be some kind of a member first? every time I see something that cheap, it's always for existing customers only

and of course the two hosting providers I rent from don't offer code signing certs

Oliver Salzburg

11:15 PM

@allquixotic You sign up as an author and then request a certificate. It is issued from Comodo. There's no funny business

I used it to sign all the applications and the installer in one of the software products at a previous employer

The certificate is valid for 1 year. Signed binaries will always be valid, you just can't sign anything new after 1 year. But I guess you know that

you know what, all of this sounds like waaaaaaay too much trouble and money out of pocket just for something for work... they can either click "Run Anyway" every time they start Word, or I'll figure out a way to import a self-signed CA that'll get it to stfu

@allquixotic You could try StartSSL?

Oliver Salzburg

Well, they should pay for it and validate the request if it's for work

@Bob StartSSL is broken

you can't even sign in

?

worksforme TM

11:17 PM

apparently it's been broken for 3-4 years

auth.startssl.com

> SSL peer was unable to negotiate an acceptable set of security parameters. (Error code: ssl_error_handshake_failure_alert)

tried Chrome, FF and IE

haven't tried IE 6 though, that's probably what it'd take

Oliver Salzburg

@allquixotic worksforme too

I was going through the access logs on my home server, and I was getting hit by a botnet that emulated IE6... On Windows 98

@allquixotic nope in chromium

Oliver Salzburg

I signed up about a year ago, but haven't made use of their services yet

@OliverSalzburg wtf...

does that maybe mean that my ISP is doing some kind of MITM?

Oliver Salzburg

11:20 PM

@allquixotic When I clicked it a minute ago, Chrome asked me to select a client cert. I did select the one I installed and the site loaded

how the fuck would you guys be able to get here without a problem while I can't?

Oliver Salzburg

Now it just opens instantly

@OliverSalzburg Chrome asked you to select a client cert? just to get to auth.startssl.com?

Oliver Salzburg

@allquixotic Yeah

@allquixotic I'm getting the issue in Firefox

11:20 PM

I've never heard of it requiring a client cert to get to the registration site before...

wow. that's very bizarre.

Oliver Salzburg

user image

That's from a different profile

Same error in Chrome, and doesn't load ANYTHING in IE11

the other problem I've had with startssl is that, no matter what time of day I try it, I always seem to get error messages that they're over capacity

it seems like they're running a web server hosting stack from ~1999 or so

Oliver Salzburg

Maybe your client certs have run out

Uninstall them

I don't have a client cert

I want to get one

but to get one, I have to go to that site

it's a catch-22

Oliver Salzburg

11:22 PM

Ah, I see

Weird

now that I think of it, I believe startssl requires notarization too, doesn't it?

not for the class 1 SSL cert, but certainly for code signing they would

@allquixotic I got a client cert half a year ago when I got their free SSL certificate

Oliver Salzburg

Well, StartSSL is really only useful to get free HTTP SSL certs for your personal website. And those are like 15 bucks per year anyway

but I'm at work right now, so I can't check if it works

Oliver Salzburg

There are no free code signing ones

11:23 PM

@OliverSalzburg not free, no, but for $59 it's not bad

though...

One thing to watch out for though is that according to stackoverflow.com/questions/2213784/… StartSSL certificates have the "Lifetime Signing" OID set which means that signatures will be marked as invalid after the certificate expires, even if it was timestamped. — BruceCran Aug 4 '10 at 22:39

Oliver Salzburg

@Bob Indeed

@OliverSalzburg but they do sell code signing certs for money, they're cheaper than even tucows as well

Oliver Salzburg

@allquixotic I see, I see

@allquixotic start here: startssl.com

click sign up quickly

otherwise it tries to redirect

as for using it to sign, blog.assarbad.net/20110513/startssl-code-signing-certificate

startssl.com/?app=25#60

> Object Code Signing certificates require at least Class 2 identity validation. In order to obtain the certificate a certificate signing request must be prepared beforehand. Thereafter the signing request must be submitted to the StartSSL™ Certificates Wizard.

startssl.com/?app=34

> Prepare at least two recent documents, which are scanned by a scanner or photographed by a digital camera. These pictures should be in high quality and high resolution but should not cross the size of 1 MB. Alternatively your may also upload PDF files. It is important, that all the details are clearly viewable, for example:

The cover of your passport
The first pages of the passport
The picture of you with your personal detail of your passport

and

Both sides of your drivers license or identity card or

so, yea. quite a fair bit of personal info

dunno if it needs to be notarised or not

@allquixotic muchtall.com/2013/05/22/…

> Get Personal Class 2 validation (~$60)

Submit 2 forms of ID
1 Photo ID (i.e.: Driver's license)
1 other form of ID. May be photo (i.e.: Passport), OR non-photo (i.e.: birth certificate)
AND submit either:
Phone bill showing your name, current address, AND (most importantly) phone number.
May be land line or cell

OR
Request for certified mail validation
Delivery will take ~2.5 to 5 weeks (from Israel)
If expedited service is required, you may additionally request express mail (~4-5 bus. days) for approx $30.

read below on that page for more detail

it's... interesting o.O

> The second half of this, and this is where I got hung up, is the verification that the person submitting the information is YOU. StartCom apparently trusts phone companies, because you "just" need to submit an invoice/bill showing your name, address, and phone number. This can be either a scan/photo or a PDF. This is where I got hung up. My current cell service is not in my name, and I have Ooma VOIP for home phone service, which doesn't do traditional paper or PDF invoicing. Attempts to submit website screenshots, or PDFs of a webpage will likely be rejected. StartCom needs to be able to…

heh: startssl.com/?app=37

once you're validated, the certs are free

interesting

11:39 PM

yay, $3.98 for basically a little hole in the wall domain that's unlikely to be noticed unless people are just monitoring the whole WHOIS database for new incoming records and mining personal info from it

@allquixotic actually... I hate to say this, buuuut...

(yes, some people do do that. I've had some spam for setting up a website or some shit)

(as if I'm gonna pay someone who spams me to build a website I don't want for me. fuck off)

@allquixotic if you use startssl, I don't think they require a domain

though I could have remembered wrong

@Bob did you actually go through with the code signing process?

@allquixotic no, I've only ever done class 1 with them

but that was a while ago

(from other sources, it looks like class 2 doesn't require a domain for verification)

I can't remember if I used gmail or my own domain for class 1, though

and I can't check right now

I can check tonight if you remind me :P

actually, I might still have that email

NO FUCK OFF GOOGLE

it's less than $4 for a domain with an email address for a year, so I'm not worried about that

one company I actually like is Namecheap, except that they don't do code signing certs

user image

FUCK YOU GOOGLE

THIS HAS GONE TOO FUCKING FAR

3

11:47 PM

everything I've ever seen from Namecheap has been reasonable

@Bob THE LINE MUST BE DRAWN HEAH! THIS FAR! NO FURTHER!

That's it. I'm setting up my own mail server.

oh yea

@allquixotic my startssl account was created with a gmail email using plus addressing :P

@Bob plus addressing? what's that?

@allquixotic email+anything@gmail.com

emails sent to that address will redirect to email@gmail.com

i.e. it ignores the + and everything after it

often rejected by crappy validation

o_O.... what's the point of doing that?

@allquixotic uh.. so you can block off spam if the address gets leaked?

you can filter by which it was sent to

most spammers don't bother to extract the base address

11:55 PM

@Bob openxchange webmail comes free with new namecheap registrations :D

so i don't even have it forwarding email from my public whois email to my gmail :D

I have better than that :D the spam goes to an inbox I never check unless I'm doing registrationy certificatey things :D

3 GB quota

@allquixotic until you find out that they're revoking your certificate because you didn't respond :P

considering most spam isn't very large, that should last me a while

I should have my own email server by sometime next year (procrastination...), at which point I can just not care about quotas

lol, my domain is so new that i can't email my new domain because the DNS hasn't propagated through yet

@Bob I don't trust myself to maintain a rigorous enough production environment for that kind of thing

not that I'm anywhere near gmail's limits, but I now consider google completely stupid and evil, so... ya

11:59 PM

sadly, I trust Google and their spying more than I trust myself because I'd somehow lose all my data

@allquixotic true, that's a risk

Google won't lose it; they want to keep it so they can scan it and send it to the NSA :D

@allquixotic I don't even care about spying. I just don't want those FUCKING MESSAGES TELLING ME TO MAKE A FUCKING GOOGLE FUCKING PLUS ACCOUNT

« first day (1245 days earlier) ← previous day next day → last day (3777 days later) »

Transcript for

Jan '142

Root Access

For all you Super Users out there. You have backups, right?

computers technology

join this room
about this room

00:00

06:00

12:00

18:00

all times are UTC

site design / logo © 2024 Stack Exchange Inc; legal

mobile