Category Archives: Policy

Disabling SSL3 and 3DES support to improve security for CAcert’s users

CAcert intends to disable SSL3 and 3DES support for its main website www.cacert.org by December 1, 2014.

The main CAcert website is currently still supporting the SSL3 protocol for secure connections. However, in https://www.openssl.org/~bodo/ssl-poodle.pdf  it is shown that SSL3 is susceptible to certain cryptograhical attacks. While www.cacert.org does support the recommended TLS_FALLBACK_SCSV option to protect clients with that same protocol option against unintended downgrades to SSL3, this still leaves plain old SSL3 clients vulnerable for the new attack.

Similarly, www.cacert.org is currently still supporting the 3DES cipher suite for encyrpting secure connections. However, this provides only 112 bits of security, which is below the currently recommended number of 128. Hence we should disable it to protect CAcert’s clients.

In practice, the only client known to negotiate SSL3 with www.cacert.org is Internet Explorer 6.0 as found in Windows XP. Thus disabling SSL3 will block https access for these clients only. Similarly, 3DES will only be negotiated by IE 6 and IE 8 running on Windows XP. Since Windows XP is no longer supported by its vendor, and the widely circulated advice to all its users is to switch to a more recent operating system (or switch at least to a more current browser), announcing termination of support for SSL3 and 3DES by CAcert on December 1, 2014 does not seem unreasonable, and is fully in line with our mission to support the security of its users.

If you want to discuss this issue further, please use the bug tracker created for this issue (https://bugs.cacert.org/view.php?id=1314).

The policy group has started a new vote on “CCA – Update” (CAcert Community Agreement)

CAcert-vote p20140709After a long period of inactivity on the policy side, we are back in
in business again.

In February board nominated a Policy Officer (Eva Stöwe) and this was later
confirmed by a Policy Group vote.

At about the same time an intensive discussion regarding changes to the CCA
started.

There are a lot of changes, some of them being just cleanups or
rephrasing, but there are also some bigger changes.

The central changes are:
– The CCA can be accepted by more ways than currently allowed.
– How CCA may be terminated was greatly rephrased, it now also covers
death of members.
– A clear obligation to answer truthfully before and to help arbitration
was added.

If you want to follow the discussion visit the archive on
https://lists.cacert.org/wws/arc/cacert-policy.

The actual version of the proposal is located here:
http://svn.cacert.org/!svn/bc/2568/CAcert/Policies/CAcertCommunityAgreement_20140708.html

Every community member is also invited to participate by joining the
policy group. Just subscribe the mailing list cacert-policy@lists.cacert.org

The state of the voting can be found at https://wiki.cacert.org/PolicyDecisions#p20140709

The voting stays open until Sunday 27th of July 2014.

ATE-Wiesbaden, 22. Mai 2014

Am Donnerstag, 22. Mai 2014 findet in den Räumen des CCCMZ e.V. in Wiesbaden das nächste ATE in der Region Rhein-Main statt.

  • Was hast du auf dem CAP Formular hinzuzufügen, wenn du Minderjährige überprüfst ?
  • Warum solltest du dir die 3 Buchstaben: R/L/O einprägen ?
  • Wie verhälst du dich, wenn du ein fremdes Ausweis Dokument zum ersten mal prüfst ?

Continue reading

New Vote on a policy change


The policy group as just created a new vote on “DRP – minor changes, excluding controversial issues” https://wiki.cacert.org/PolicyDecisions#p20121213

After one year of no activity on the policy side we are back in to business again.

If you want to follow the actual discussion just visit the archive on https://lists.cacert.org/wws/arc/cacert-policy.

The voting on the motion p20121213 is closed now.

The motion is CARRIED with an overwhelming consensus of 30:0.

Thank you all for participating!

Merry Christmas and a happy new year to everyone!