WoSign and StartCom: Mozilla's proposed conclusion - <AUTHOR> https://docs.google.com/document/d/1C6BlmbeQfn4a9zydVi2UvjBGv6szuSB4sMYUcVrR8vQ/preview <comment><USER2> >We also hope the public can see that when there are allegations of CA wrongdoing, Mozilla is committed to a fair, transparent and thorough investigation of the facts of each case.

I'm very happy to see the way Mozilla handled this incident, both with the process and the conclusion. I have a moderate trust in the CA ecosystem as a whole, but I'm glad to see that overwhelming incompetence, if not outright maliciousness, does have consequences even to big CAs.

At first though the proposed one year timeout can seem a little short given the impressive list of reported issues, but the conditions given for re- acceptance are strict enough that passing could only indicate a radical change in methodology, at which point it would only make good sense to consider a re- inclusion.

In fact if every CA could take a full code security audit and provide complete certificate transparency in the manner proposed, I think we would have reason to feel marginally safer on the Internet.

<comment><USER3> >In fact if every CA could take a full code security audit and provide complete certificate transparency in the manner proposed

Given the risks that screwups have to their business, I would think CAs would VOLUNTARILY do this.

<comment><USER4> Giggle.

Look at Diebold's numerous malfeasance issues in ATM and voting industries. If anything, they have much more to lose by voluntary audit.

Unsavory CA's might well be in the same position.

<comment><USER3> Can you elaborate? I am not familiar with the specifics of Diebold's problems and how a voluntary audit (which they could choose to keep private and use for internal assessment) would hurt them more than not knowing the risks.

</comment></comment></comment></comment><comment><USER5> A clear and detailed report. The conclusion seems both transparent and fair. It would be very difficult for many customers of StartCom/WoSign if they were immediately revoked. Hopefully this news spreads far enough that the reputation of StartCom/WoSign will generally include this information.

I am saving this as a reference in the event I ever need to write a technical report. This style is so much easier to read than a typical "official" report from police, the FBI, or similar organizations.

I don't have any StartCom or WoSign certificates right now, but I did in the past. It was nice to be able to get a certificate that browsers accepted, without needing to pay for it. I'm glad the landscape has changed.

<comment><USER6> Yes, we are very fortunate to have Let's Encrypt now.

<comment><USER7> One problem - at least for the project I'm working on - is that Lets Encrypt isn't a replacement for all of StartCom.

We use a StartCom "MS Authenticode" certificate to sign our releases, so Windows users don't get a warning message from the various anti-malware scanners (and similar).

At first glance it sounds like Mozilla not accepting new StartCom cert's at some point won't affect that. It may snowball, but that's an unknown. o_O

<comment><USER8> Same here, I've just recently obtained a "Class 2 Code Signing" certificate from StarCom for digital sign my Windows software - as a individual software developer from China, I don't even have alternative options - I tried purchasing from Comodo, but unfortunately there process for checking individuals from out out of the US is extremely difficult.

So I wish this would not affect the certificates StarCom issued for code signing.

<comment><USER9> I use (reasonably cheap, using MSDN discount) DigiCert one, and I'm an individual living outside US. Very little hassle involved.

<comment><USER8> Thanks for the info, will DigiCert once the startcom code singing cert. is no longer relevant on Windows :;

</comment></comment></comment></comment></comment></comment><comment><USER10> I like this part at the end:

> In addition, Mozilla will:

> add all of the Macau certificates to OneCRL immediately;

> and no longer accept audits carried out by Ernst & Young (Hong Kong).

If you don't hold the auditors responsible, this will happen again. If you do hold the auditors responsible, you might prevent some of this.

</comment><comment><USER11> While most of the doc focused on StartCom/WoSign, I thought this bit at the end was interesting:

> no longer accept audits carried out by Ernst & Young (Hong Kong).

To reject audits from E&Y.... It makes me wonder about the transparency and trust we put in the auditors as being a key part of CA validation process.

<comment><USER12> Auditors and ratings agencies and their ilk are a fundamentally broken service in our society. On the one hand they have to make money and on the other they have to be honest. The two are simply not compatible, seemingly. Eg: ratings agencies happily giving top tier ratings to mortgages back in pre 2008.

<comment><USER11> Completely Agree!

When you think down this path, its why Certificate Transparency Logs make even more sense -- Yes, its still ideal that a CA operates in a "good" way, but using the Cert Logs you know everything they have signed, so a rouge actor has a limited ability to sign something they shouldn't, and as seen by Mozilla's document, they used the Cert Transparency logs as part of their evidence.

</comment></comment></comment><comment><USER13> Mozilla and Chrome are killing StartCom. This is huge, isn't it? StartCom is one of the more popular CAs.

 _Later:_

Additional fun fact: there's a decent-sized subthread on the mailing list in which it's strongly suggested that WoSign is itself quietly owned by Qihoo360, a much larger company --- somewhat like the Symantec of China.

More specifically:

[https://twitter.com/pzb/status/780456712562024448](https://twitter.com/pzb/status/780456712562024448)

<comment><USER14> They're not "killing" anyone. They have reasonable doubt that the CA has misrepresented the truth and engaged in practices that violate the rules set forth by the CAB and those for inclusion in the Mozilla trust store. There will have to be consequences for else it means nothing.

They're also very clear that they do not intend to invalidate any already issued certificates, only new ones after a specific, yet to be decided, date and that they remain open to re-inclusion after the year's time-out and passing the normal inclusion tests. However, they rightfully set forth a requirement for some audits to take place by Mozilla appointed parties. For this I'm particularly thankful as if the auditors are allowed to keep doing this kind of hodge-bodge botch job the already strained trust in CA's is further weakened.

<comment><USER15> They're absolutely killing WoSign/Startcom. It's totally justified, but it's what they're doing.

<comment><USER16> WoSign/Startcom signed their own "death warrant" by engaging in fraud.

I only wish death sentences for companies participating in blatantly fraudulent activities would be issued more regularly by regulatory agencies.

</comment></comment></comment></comment><comment><USER17> Well shit. I always liked StarCom because of their approach to charge for verification (with increasing costs for each higher trust level) but not for issuing certs (while still manually checking every cert request, at least for any OV&EV cert in my case). This entire WoSign acquisition is incredibly shady. Shortly after that some of the customer reps had chinese names, service quality declined and we got offered to become an "Intermediate CA" (StartPKI) for 10k$/yr.

What is the best alternative CA that also offers wildcard certificates (preferably with a similar business model)?

<comment><USER18> What use case do you have for wildcards that you can't use Let's Encrypt or similar automated issuance? Just curious, as I've yet to hear a terribly compelling one...

<comment><USER19> Not the parent, but wildcard certs are necessary for compatibility with clients that don't support SNI (ex: IE on WinXP)

<comment><USER20> No. You could also issue SubjectAltName certificates. Works fine with XP.

</comment></comment></comment></comment><comment><USER21> I'm not going to defend WoSign/StartCom's shady tactics, but the way the deprecation of SHA1 was performed puts people in a pretty shitty position.

You can't support Windows XP users who use IE anymore with HTTPs.

In the western world, that number is very small. It's around 1% still using XP and most of those people are probably not using IE anymore.

In china though, that number is still >5%, and I got that number personally from the metrics of a game that we just deployed an alpha for in China. I would bet that given the way the alpha test keys were handed out that the amount of Windows XP users in the general population is probably much much higher.

So what is the response if you can't support a significant portion of your user base? Well for a bunch of chinese websites the result is _don 't use HTTPS at all_. We have seen advice that "HTTPS cases problems for users in China so we think it's a bad idea to use it". It's not a good situation.

<comment><USER22> > You can't support Windows XP users who use IE anymore with HTTPs.

Sure you can. Just ask a CA that has an old root trusted by XP but no longer trusted by modern browsers, and they'll issue a SHA-1 cert for you without risking to get kicked out of the truststores.

<comment><USER21> And what about all the modern browsers you also need to support?

<comment><USER23> It's possible to determine whether a client supports certificates using SHA-2 by analyzing the ClientHello and use that to switch between a SHA-1 and SHA-2 certificate. CloudFlare[1] and some of the bigger sites like Facebook have done this.

[1]: [https://blog.cloudflare.com/sha-1-deprecation-no-browser- lef...](https://blog.cloudflare.com/sha-1-deprecation-no-browser-left-behind/)

<comment><USER24> And here's the technical detail of how we do it: [https://blog.cloudflare.com/tls-certificate-optimization- tec...](https://blog.cloudflare.com/tls-certificate-optimization-technical- details/).

<comment><USER21> Is there actually an open source implementation of this though?

I've looked, but never found one, though that was quite some time ago. Perhaps things have changed.

This approach is beyond the ability of most to implement for themselves if they don't have support from their webserver for it.

<comment><USER22> You can do it with HAProxy by checking for SNI and falling back to a SHA1 cert when the extension is absent. [https://jve.linuxwall.info/blog/index.php?post/2015/10/04/SH...](https://jve.linuxwall.info/blog/index.php?post/2015/10/04/SHA1/SHA256-certificate- switching-with-HAProxy)

</comment></comment></comment></comment></comment></comment></comment><comment><USER25> Now that StartSSL is effectively deceased, is there a commercial CA that supports the ACME protocol? Or is the ACME protocol a vanity project unique to Let's Encrypt?

I manage several dozen certificates; I was very pleased when StartSSL offered an automated API to work with. Despite their flaws, they offered EV certs, wildcards, and automated one-shots, and it was very convenient.

I'd gladly pay for this functionality, preferably while supporting standards- based ACME functionality... but so far it seems Let's Encrypt is the only one playing that game, and their featureset is crap for anything but their very narrow use case.

Any advice, HN?

<comment><USER26> I'm the founder of SSLMate, which resells Comodo and GeoTrust certs with an automated, ACME-like API: [https://sslmate.com](https://sslmate.com)

Our API predates ACME, but we'll most likely be implementing ACME once it's finalized.

<comment><USER27> What's your take on the Comodo trademark claim on Let's Encrypt, and all the BS that ensued?

[https://news.ycombinator.com/item?id=11964583](https://news.ycombinator.com/item?id=11964583)

I personally immediately replaced all of my and my company's comodo certificates with DigiCert ones.

<comment><USER26> The incident was terrible, but it is not a reflection on how their CA is run. They run a trustworthy CA and employ some really awesome and competent people (e.g. Rob Stradling) who actively contribute to improving the Web PKI, such as by (co-)authoring the CAA, Must-Staple, and Certificate Transparency standards. They run [https://crt.sh](https://crt.sh), which is an invaluable resource for investigating Web PKI problems (the Mozilla report and associated mailing list threads are peppered with crt.sh links). If their trademark filings had amounted to actual legal threats against Let's Encrypt I would hesitate to send them business, but it seems more like their CEO is just a giant blowhard. The good they do makes up for it.

In contrast, I'm much more appalled by Symantec/GeoTrust's misdeeds (e.g. issuing unauthorized "test" certificates for google.com, badly botching the SHA-1 deprecation, cross-signing the US Federal PKI). I think Symantec is incompetent and contributes negatively to the Web PKI. I no longer issue their certificates by default, and am going to replace them with a different CA.

<comment><USER27> Thanks for the insight!

</comment></comment></comment></comment></comment><comment><USER28> This is a very detailed investigation - the parts that appear to be new are the specific serial number patterns, the times/dates of manual issuance, and the case of the Tyro SHA-1 cert.

It's a little unfortunate that Mozilla's option here is to rely on WoSign and StartCom continuing to be honest about notBefore, or really, on Google detecting further abuse of notBefore via Certificate Transparency. Mozilla should really be participating in CT themselves so they have more options here. Is there anything the community can do to help (e.g., run more log servers)?

<comment><USER29> > Google detecting further abuse of notBefore via Certificate Transparency

You don't need to rely on Google. All certs issued by WoSign since January 1st, 2015 should be on WoSign's own Certificate Transparency log from which you can download them. StartCom is logging all new certs too, but I don't know for sure if they pushed all older ones too. If you ever encounter a cert that isn't on the list, that's definitive proof that they are backdating again.

The list of certificates is too large for Mozilla to include a list of hashes in Firefox, but it might be a nice opportunity for a Firefox add-on.

<comment><USER30> _> You don't need to rely on Google ... should be on WoSign's own Certificate Transparency log which you can download_

Given that the behaviours being documented include falsifying data (backdating certificates to get around SHA1 retirement), I would prefer to at least use information from Google (or another third party) for the purpose of verification, rather than just relying on information sourced from WoSign/StartCom.

<comment><USER29> They can't backdate their Certificate Transparency log without leaving cryptographic evidence behind. That's how CT is designed to work.

Of course, simply being in the log doesn't imply the cert was issued correctly, but the logs have been posted for a couple of months now and have received a lot of scrutiny during Mozilla's investigation. But the same is true for Google's log, presence in that log is also no guarantee that it was issued correctly.

</comment></comment></comment></comment><comment><USER31> Goddammit. I really liked StartCom for free S/MIME certificates and TLS certs that don't expire after a month.

So people, is there a comparable free product out there (don't say LetsEncrypt, they don't do S/MIME unless I'm mistaken)?

<comment><USER13> Why are you using S/MIME?

You can still get free S/MIME certs from Comodo.

<comment><USER32> What is wrong with S/MIME?

<comment> TD-Linux It has less users than PGP/MIME, which is an impressive feat.

<comment><USER33> Since many major clients support it out of the box, I'd say that at least for verification purposes, it has more users than PGP/MIME.

</comment></comment></comment></comment></comment><comment><USER34> I'd be interested to know what the plans are from other vendors (Microsoft, Google, Apple, ...); can we expect them to follow Mozilla's lead in taking action against WoSign?

<comment><USER35> When the story first broke, I manually untrusted WoSign's and StartCom's root certificates in OS X, instead of deleting them outright...at least I thought I did. I upgraded to macOS 10.12 Sierra this past weekend, and repeated the process. Except WoSign's certificates aren't there to begin with, though StartCom's still are. So perhaps Apple had dropped WoSign already? Would anyone else running 10.12 verify?

<comment><USER23> IIRC WoSign was never in Apple's trust store in the first place; their trust status came from StartCom cross-signing their certificates.

(Not sure if cached intermediate certificates get added to the keychain - maybe that's what you saw previously?)

<comment><USER36> I can say +1. WoSign has never been in OS X trust chain as I hit this issue once before and had to install it myself manually. You can search about WoSign and OS X on Google and you will see that it was never there. If you found it in your trust store in the first place, there must be some shady business going on in your Mac. Also similar comments in this other HN thread: [https://news.ycombinator.com/item?id=12389573](https://news.ycombinator.com/item?id=12389573)

</comment></comment></comment></comment><comment><USER37> TL;DR:

> Taking into account all the issues listed above, Mozilla's CA team has lost > confidence in the ability of WoSign/StartCom to faithfully and competently > discharge the functions of a CA. Therefore we propose that, starting on a > date to be determined in the near future, Mozilla products will no longer > trust newly-issued certificates issued by either of these two CA brands.

I recommend reading the whole thing if you have time. They used some shady tactics.

</comment><comment><USER38> A 1 year suspension and continued trust of previously signed certificates?

Sounds very generous to me.

<comment><USER13> How many companies can survive a year without revenue? None I've ever worked at. Not only that, but their readmission after that year is uncertain! Mozilla gets to pick an auditor ( _raises hand! pick me!_ ) that gets full access to their code. This is, I think, a higher bar than a new CA would have to clear.

StartCom is a popular CA. Distrusting previously-issued certificates would be extremely disruptive. Moreover, it would primarily punish StartCom's customers, and not WoSign, which as a business is primarily concerned with forward revenue.

You see this as leniency, but I see it as a powerful step forward. The browsers and CAs had previously been locked in a Mexican Standoff, with abusive CAs fully aware of the leverage their userbases offered them.

<comment><USER39> Not only is it a year without revenue... I imagine this will devastate their revenues in future years as existing customers up for renewal during that time will likely permanently migrate to another CA.

<comment><USER13> It looks like Mozilla and Google have created a set of circumstances where the rational next step would be to wind down WoSign/Startcom and just start a new company.

<comment><USER22> Which would require creating new roots to be submitted to Mozilla's CA program, and passing the bar for inclusion of a new CA.

That's a multi-year process, unless they can get another CA to cross-sign their root, like LE did. I doubt other CAs will be willing to carry that level of risk given the reputation of WoSign/StartCom.

</comment></comment></comment></comment></comment><comment><USER40> I think this is very well handled on the part of Mozilla, especially with respect to existing customers.

What's missing, which admittedly is not Mozilla's job, is to inform any existing customers that will have to renew during the time WoSign and StartCom are suspended. If they just get an invoice and pay it or are set-up with auto- renew, they'll unknowingly get certificates that aren't valid for the remainder of the suspension (or indefinitely, if WoSign/StartCom if violates Mozilla's requirements).

</comment><comment><USER41> Wow, this would be devastating if they actually went through with revoking their root certificate.

StartCom is (well, _was_ ) the _only_ competition to Let's Encrypt in the free certificate space. It is far and away the cheapest _direct_ provider of wildcard certificates (which are impossible to get for free), unless you move into reseller territory. And even their free certificates last four times as long, and don't require the use of certbot.

Certainly, Let's Encrypt works great for a lot of peoples' needs. But for those it doesn't (and there's more of them than you might think), this is _seriously_ bad news.

It's easy to get onboard wanting to punish WoSign/StartCom here, but keep in mind that this has the potential to screw over all of their innocent customers as well. (Future customers with the first action; all customers if the second action comes to pass and they revoke the root CA.) And screwing them could likely mean they abandon HTTPS completely instead.

Note that I am _not_ advocating for Mozilla to give them a pass; far from it. If anything, this is just one more indictment on the long list of reasons why the entire CA system is completely broken.

I actually just recently purchased a certificate, and had my choices narrowed down to StartSSL or AlphaSSL. I am _really_ glad I went with the latter right about now. I can't tell you how absolutely livid I would become if Mozilla ended up revoking my root CA after dropping over $100 on my certificate.

<comment><USER42> Surely you could have demanded a refund if you had chosen StartSSL and they sold you what turned out to be a defective product?

<comment><USER43> Good luck collecting after the company's potential future revenue has been erased.

<comment><USER41> Best recourse would be a credit card chargeback. If Paypal, probably a writeoff.

The trickier part is, it's unknown whether StartCom will backdate more certificates, triggering Mozilla to block them entirely. That could happen well after the window where you're allowed to request a chargeback. Although I do believe it's _extremely_ unlikely that they will. Unless Google and Microsoft follow suit, such an action is just as likely to damage Mozilla as it is to damage StartCom. People who just want to access websites will not bother to understand the reason why suddenly only Firefox is refusing to let them view their pages.

</comment></comment></comment></comment><comment><USER44> Just curiosity: since this report is a Google Doc, how can one know that it has been really written by Mozilla?

Shouldn't it be under the mozilla.org domain?

<comment><USER45> Being hosted where it is is particularly annoying because you can't view it unless you accept cookies from google.com.

A JavaScript redirect takes you straight to [https://support.google.com/accounts/answer/32050](https://support.google.com/accounts/answer/32050).

</comment></comment><comment><USER46> I'm going to make a donation to Mozilla for this. Top work of public value.

</comment><comment><USER47> Completely and utterly fail your job, lie about it and use deceiving tactics?

And all they are getting is a 1 year suspension and none of the certificates are becoming untrusted. The auditors got a bigger punishment by being banned completely from Mozilla's trusted auditors.

Should just revoke them completely. Such incompetence and/or malice should not be allowed on such a crucial piece of infrastructure.

<comment><USER28> Revoking them completely would be a pain for end users of StartCom and WoSign certificates, who had no way to know that their CA was incompetent and/or malicious. But this is a great way to choke out their business by the end of a year, since they can't sell any new products.

Of course, it might be nice to actually revoke them so that in the future, "will my CA be revoked" is a realistic thing to think about when choosing a certificate seller. But revocation hurts other people (website owners and visitors) more than the CA, and it doesn't seem totally obvious that it's worth it.

<comment><USER48> Who cares if it's a pain? User security is vastly more important than saving companies from the mild inconvenience of changing certs.

<comment><USER14> You forget things like certificate pinning which can make sites inaccessible for long durations of time if the user doesn't visit said website during this transition period.

I'm not super convinced about the user security argument either. Sure, they backdated SHA-1 certificates and that's nasty but those certificates still expire at a reasonable time in the near future and will soon enough not be accepted by browsers at all or show up with scary UI warnings. That said I don't agree or condone what they did.

<comment><USER49> Mozilla and the other browser developers' position seems to be that issuing SHA-1 certificates when they've said SHA-1 certificates should not be issued is a cardinal sin - never mind that this would break payments infrastructure. They eventually agreed to an exception process _after_ Tyro's payments systems would presumably have stopped working if WoSign hadn't issued them a certificate.

<comment><USER50> The SHA-1 deprecation wasn't a secret: it was decided back in October, 2014. In February 2016, one provider basically said "oops, we screwed up, how can we get a SHA-1 certificate?", whereupon the answer was a one-off exception that would be notated as "yes, Symantec violated the rules, but everyone agreed to let this exception go through." This exception was converted into a more formal exceptions approval in June.

Tyro's certificate would have expired on June 9, 2016 if I'm reading the timeline right. There is nothing that would have prevented them from doing what WorldPay did and approach the CAB themselves, or become vigorously involved in the ongoing discussion (the proposal document for the process was made June 3, 2016).

On the other hand, as the IT mantra goes, failure to plan on your part does not constitute an emergency to plan on my part. The evidence is that Tyro updated its certs at the last minute, found that they couldn't get the SHA-1 they needed, and basically shopped around until they found someone who gave it to them (while lying about it!), instead of, say, making sure to request a certificate in late December to maximum the transition time available.

The great sin is not so much that they issued the SHA-1 certificate, but that they agreed not to do it, and when someone needed one, rather than bring it up with the CAB Forum, they issued one and lied about their compliance. The REALLY great sin is that they appear to have built an entire system to do the backdating, rather than applying one-offs.

Browsers can forgive CAs when they fess up to their mistakes. It's when they lie about them that they get really pissed off.

</comment></comment></comment></comment></comment></comment><comment><USER51> I think Mozilla is falling for Symantecs / other CAs propaganda here. Yes, WoSign did bad things, but those are by far not the worst things we've seen in CA wrongdoings in the last years. We've seen certs issued for MITM attacks and security holes in the validation process of nearly every CA. ([http://www.theregister.co.uk/2012/02/14/trustwave_analysis/](http://www.theregister.co.uk/2012/02/14/trustwave_analysis/)) < they confessed issuing a cert for MITM purpose and are still part of the game. The allegations mainly consist of: a) WoSign didn't make transparent that they have control over StartCom. Yes, this is a thing and it should be discussed. But the main focus of this is obviously to get StartCom into this story. Where - as I understood it - there is no allegation, that StartCom itself did something wrong. At least not in the league of "we should kill that company". Transparency is important and we should fight for it. Not only in China. b) They backdated SHA-1 certs. Obviously because not updated Windows XP machines are a thing in China. This is against code of conduct. This is bad, but I totally get the intention here. And the intention is not MITM attacks or worse (as we see a lot in CA business) the intention is not to break Chinese internet.

Bottom line: "Let's encrypt" is destroying the business of many shady CAs these days. Competition is getting harder. StartCom had an advance in this race as they adopted quickly to the new rules and the've build the best product in the market for special use cases. We - for example - rely on a lot of wildcard certs for many domains. StartCom had the product. We pay'd them $200 for all our certs and the next cheapest competitor wanted $150.000 / year for our certs. I totally get why they are getting attacked by the big players. I totally don't get why Mozilla is falling for this.

<comment><USER23> There were a number of other issues that came up during this investigation that showed that they should not be running a CA[1]. For example, they issued certificates to anyone able to control a unprivileged port (> 1024) behind a domain. They issued certificates for "root domains" to anyone able to verify control of a subdomain. When StartCom launched their issuance API, it was taken down within a matter of days due to some pretty obvious holes.

The biggest problem with the SHA-1 issuance is that they - as the report shows - blatantly lied about how this played out during the investigation and did not even attempt to go through the proper channels to get an exception from browser vendors (which other CAs did). Additionally, issuing a SHA-1 certificate to a payment processor that failed to upgrade their systems in time cannot be explained by China having a large number of XP <= SP2 users. That's just an excuse.

Regarding the TrustWave incident a few years back, it's important to understand that this happened when the rules for CAs were not quite as clear as they are now. I think this happened just around the time when the Baseline Requirements were written and were not yet in effect, and various browser policies were not as clear as they could've been about this use-case. Four years later, I have no doubts that a CA who'd give out the private key of a non-constrained CA certificate to a non-audited third-party would lose their trust status within a matter of days.

[1]: [https://wiki.mozilla.org/CA:WoSign_Issues](https://wiki.mozilla.org/CA:WoSign_Issues)

<comment><USER52> > issuing a SHA-1 certificate to a payment processor that failed to upgrade > their systems in time

Its ok, its just a temp workaround... /s - [https://tyro.com/blog/merchant- security-is-tyros-priority/](https://tyro.com/blog/merchant-security-is-tyros- priority/)

Tyro don't say when they got their SHA-1 cert from StartCom but say they needed this workaround because some of their customers still ran POS software on old operating systems such as Windows XPSP2 and that "internet security standards are moving faster than typical small merchants upgrade their systems."

> "We reached out in good faith to certificate authorities to provide a _few > months runway_ to resolve this big challenge in a way that had minimal > impact on merchants."...

To me this would be ringing so many alarm bells, why would my current CA tell me they can not issue a SHA-1 cert but StartCom say they can? (I believe they got issued the SHA-1 cert after the cutoff because of the details in the document Mozilla have supplied and that we are no longer a few months into 2016 so their need for a "few months runway" was way off) Yes it would mean my customers POS systems would still function but I'm sure as hell would be asking questions about its issuance.

EDIT: Tyro have removed their StartCom SHA-1 cert from [https://iclient.tyro.com/](https://iclient.tyro.com/) and its now supplying a RapidSSL cert issued in May of this year but yesterday they were serving a StartCom SHA-1 cert on their iclient subdomain.

</comment></comment></comment><comment><USER53> As someone who's using StartCom for several years I'm really anxious now. I may use Let's Encrypt for a few sites but not for all and I also got my email certificates from StartCom. As far as I know there's no suitable alternative that does not cost $500+ per year, or does anyone have an advice for me?

<comment><USER41> I hate to say it, but if you need the functionality that Let's Encrypt won't offer (wildcard certificates, longer validity lengths, not wanting/needing to run certbot, code signing, etc) ... your best bet is to look for the SSL resellers.

I'm not going to name the one I used (as I'm not marketing for them), but I purchased a three-year AlphaSSL wildcard certificate recently for a little over $110 (for all three years, so less than $40/yr.)

It ... absolutely defies common sense that certificate resellers are a thing; but indeed it's the very same certificate I'd have gotten had I paid $150/yr on AlphaSSL's site.

The CA model is just completely broken. But right now, our only choice is to find the lowest amount of money to be taken for if we want full HTTPS functionality. And at the moment, that's with the resellers :/

<comment><USER54> _It ... absolutely defies common sense that certificate resellers are a thing_

I think that's the kind of thing you should expect in any market where the cost of serving a new customer is dominated by the marketing & sales costs in acquiring that customer.

</comment></comment></comment><comment><USER55> Nuke it from orbit. The whole idea of PKI is Broken and Wrong and confuses two different goals.

Here's a fun one I noticed: Wells Fargo and several other banks are CAs. This is idiotic. The "logic" behind PKI dictates that it's _a third party_ identifying my bank to me. If banks themselves are CAs even that fig leaf doesn't mean much.

We have known bad actors in the pool of widely accepted CAs, right now. There's no sense bringing up obscure possibilities of MitMs that _might_ happen absent a CA system: we have bogus certs, in the wild, today. Nuke it from orbit and teach people to pin certificates.

<comment><USER28> OK, so what do you want to happen starting tomorrow morning?

* All HTTPS sites show up as trusted. Woohoo!

* All HTTPS sites show up as untrusted, people are encouraged to switch to HTTP. Woohoo!

* All HTTPS sites use trust-on-first-use, which means that we have a date and time announced when MITM attacks are particularly effective and will persist for a very long time.

* All HTTPS sites are untrusted, except for those that already have certificate pins hard-coded in the browsers' source, and excluding those that are pinning their CAs (because CAs are Broken and Wrong), which means the only websites you can access are Google's properties via Google's browser. Awesome!

* Replace HTTPS with PGP. Only people who know how to use PGP correctly get to use secure web traffic.

<comment><USER56> #3, with HKPK and a transition period covered by CAs, is not entirely unreasonable and even offers some real advantages. The changeover doesn't need to take place at the stroke of midnight.

<comment><USER28> You could engineer #3 to work, but the big trouble is that occasionally someone will reinstall their web server from scratch (on purpose or as part of disaster recovery), lose the key, and expect not to lose their website permanently. I have yet to see any organization that deals usefully with changed SSH keys and communicates them properly instead of "oh yeah, we changed that, delete it from known_hosts and it'll be fine", and organizations that use SSH are more likely to know what they're doing than the average Internet site (in fact I count MIT's CS department as one of the guilty parties). An internet-wide equivalent of "yeah, just delete example.com from your known_hosts" is essentially an internet-wide announcement of "yeah, plz start MITMing example.com".

</comment></comment></comment></comment><comment><USER57> It's a shame it sounds like there are no legal avenues for penalising the individuals behind this. Actions like this ought to be criminal. In the end, if the only penalties are directed at corporations involved it isn't much a of disincentive to state actors or others with sufficient resources who want to game the system.

<comment><USER58> Individuals? This sounds like a systemic organizational issue. I'm sure we can drum up a few scapegoats, but I'm not sure if that'll be terribly effective in fixing the incentives.

Putting _everyone_ involved out of a job and destroying whatever investments in the company they may have had, on the other hand, puts pressure on _everyone_ involved to not fuck up next time.

</comment></comment><comment><USER59> I am both surprised and immeasurably pleased at the sight that "too big to fail" isn't (yet) reality for CAs.

When it comes to shady shit like this... I would reference the title of Metallica's first album.

</comment><comment><USER60> I remember that there was some talk about double voting (WoSign and StartCom not being separate entities, but voting with two votes) in the mailing list. Is there a reason as to why this event hasn't been included in the document?

edit: [https://groups.google.com/forum/#!topic/mozilla.dev.security...](https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/0pqpLJ_lCJQ)

> "In no case were these the deciding votes."

<comment><USER23> The issue you're describing is a concern for the CA/B Forum, not really all that relevant for Mozilla/mozilla.dev.security.policy. That being said, the CA/B Forum seems to be discussing the issue[1].

[1]: [https://twitter.com/sleevi_/status/780454860676149248](https://twitter.com/sleevi_/status/780454860676149248)

<comment><USER60> Thank you, though the Qihoo relationship is not what I was referring to.

I actually meant executing two votes in the CA/B Forum. As the connection between WoSign and StartCom was only incidentally found while investigating the other issues, I am questioning if there may be more dark sheep in the herd of CAs... we may just haven't looked hard enough. Do the Audit Requirements include checking for such relationships?

<comment><USER23> That's in all likelihood the same issue - Qihoo de facto owning two CAs who currently cast two separate votes in the CA/B Forum. Not sure if it would be a concern otherwise (i.e. if Qihoo were to own just one CA and not disclose that fact, I don't think that's relevant for the CA/B Forum, leaving aside the problem that they're also a member as a browser vendor ...)

I think the voting rules are part of the bylaws (and not the Baseline Requirements), so I'm not certain if that's something that's looked into during the audits.

</comment></comment></comment></comment><comment><USER61> Is there a governing body or regulatory authority which looks over the process followed by CAs ?

As a fan of firefox, I am happy that as a community, Mozilla has done the necessary ground work to reach this conclusion. However, as long as PKI remains a highly profitable business, more and more such events are going to happen.

I don't think all CAs should be trusted equally. Right now, AFAIK, my browsing experience is only as secure as the weakest CA. Hopefully, HPKP can put an end to this.

</comment><comment><USER62> Shoot, I just renewed two of my domains with the free StartCom certs on Friday... Even though I'll likely have minimal-to-no impact, I'm still very disappointed with this.

</comment><comment><USER63> Well, this is as good a week as any to migrate my certificates to Let's Encrypt. I just need to figure out how to do domain validation.

<comment><USER64> I stopped using startcom after their response to the heartbleed vulnerability.

<comment><USER63> That really should have been my clue.

</comment></comment></comment><comment> Ruud-v-A I'm glad that I have been distrusting Startcom on all my devices since early 2014. Time to do the same for Wosign.

</comment><comment><USER65> How can I check if I am using one of their certificates?

</comment><comment><USER66> While I agree that they did the wrong thing and WoSign/StartCom should be punished for lying, the whole sha-1 deprecation thing is very black and white. Others have successfully gained "exemptions" to do precisely this, and it's an interesting question whether it would have been easy for WoSign to get those same exemptions if they'd just asked. I bet the answer is "possible but not easy".

Meanwhile:

[http://security.stackexchange.com/questions/86609/this- is-20...](http://security.stackexchange.com/questions/86609/this-is-2015-has- sha1-been-exploited-or-cracked-yet)

[https://www.schneier.com/blog/archives/2015/10/sha-1_freesta...](https://www.schneier.com/blog/archives/2015/10/sha-1_freestart.html)

"Freestart collisions, like the one presented here, do not directly imply a collision for SHA-1"

"this work is an important milestone towards an actual SHA-1 collision"

[https://en.wikipedia.org/wiki/SHA-1](https://en.wikipedia.org/wiki/SHA-1)

"SHA-1 is no longer considered secure against well-funded opponents".

AKA, SHA-1 may not be secure against a nation state or attacker with a ton of money, but it's secure enough against for almost every site against almost every attacker. Given the reported 5%+ of Chinese browsers not supporting newer certs, I can see why customers might want a cert that gives them a lot more than nothing, though less than best-of-breed.

It's the one-size-fits-all where someone's personal blog needs to have the same level of security as the apple app store's payment system that leaves them filling a real market need. They didn't go seeking people wanting SHA1 certs, people wanting SHA1 certs that would still work went seeking someone who would provide them.

And they went seeking because the alternative is upgrading potentially millions of dollars worth of embedded kit which doesn't support newer certs, all to secure one link in a chain in which SHA1 is nowhere near the weakest link.

So yeah, the CAB chose to inflict a ton of pain and cause still-functioning hardware to be discarded in order to push a more secure ecosystem on everybody. Which is great from some perspectives, but it's environmental vandalism from another perspective, and if it pushes people back to non-HTTPS traffic for those older pieces of equipment it could cause a short term worsening of security.

(the deprecation of sha1 that is. The lying by WoSign/StartCom was a calculated risk in a business where everything is based on trust, and they lost)

<comment><USER67> > I bet the answer is "possible but not easy".

I would bet the same. This seems like what you want for an exemption process: if it's too easy, people will use exemptions rather than fixing an underlying problem.

> someone's personal blog needs to have the same level of security as the > apple app store's payment system

Different grades of security would not have helped in this case, because it was payment systems having trouble updating, and we put anything involving money on a high security tier - except when legacy systems get an exception.

It's not quite one-size-fits-all, because EV certificates are meant to show more trust, and most banks etc. will use those. That takes extra work, which isn't worth it for a personal site. But you don't save any work by using a weaker hash algorithm, so there's no reason for a personal blog to do so.

> the CAB chose to inflict a ton of pain and cause still-functioning hardware > to be discarded

It does sound like they should have had an exemption process set up before the cutoff date, or put the cutoff further out to give people more time to upgrade systems. But using Hanlon's razor, it was probably an oversight rather than deliberate 'environmental vandalism'.

</comment></comment><comment><USER68> So I don't like Let's Encrypt, if Mozilla "kills" WoSign/StartCom, what are my options if I want a cert for free?

<comment><USER69> What exactly don't you like about Let's Encrypt? Besides Let's Encrypt, your other option is paying for a cert from GoDaddy or something. My two cents: don't give business to Comodo, given their horrible track record of sleaziness ([https://en.wikipedia.org/wiki/Comodo_Group#Controversies](https://en.wikipedia.org/wiki/Comodo_Group#Controversies)).

<comment><USER68> I don't like the EFF, but I guess I will have to use Let's Encrypt if there's no other option.

<comment><USER70> If I might ask, why don't you like them?

<comment><USER68> They are a political organisation and their ideas conflict with mine. I don't keep a strong boycott on them, but I don't want to support their products, that's all.

<comment><USER71> I'd be very interested to know which of the EFF's political positions you object to, but it appears pretty clear you're avoiding answering that question...

<comment><USER72> I don't see how that's relevant, unless the goal is to invalidate his(?) dislike of them by claiming the political views that dislike is based on are wrong and stupid.

<comment><USER71> The goal was to find out more. Having never encountered an anti-EFF person on here (or anywhere, that I can recall) I was interested in the answer.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER73> why is this google docs ? why is this not atleast a markdown file in github ?

<comment><USER74> From tptacek:

"It was written by multiple authors. Ryan Sleevi is at Google."

I would assume the method it was written in is of little consequence to many, just that Google Docs offer far better convenience when working in teams.

</comment></comment><comment><USER75> If the CA market were efficient this would lead to bankruptcy of this company since there's no reason to chose them over the many competitors and many reasons to distrust them. Though of course the market is not efficient. I keep wondering when the Communist Party of China is going to make its heavy handed presence felt in the CA world.

<comment><USER76> Even after this disclosures, a fully informed, rational agent would still choose WoSign if their price and service were the best. This is because WoSign's behavior does not specifically endanger their customers.

The SSL ecosystem relies on the trustworthiness of the certificate authorities. If one of them is compromised, the whole system is compromised, not just their customers. This cannot be solved by markets. Instead, it's heavily regulated.

<comment><USER77>
      WoSign's behavior does not specifically endanger
      their customers.

Or more precisely, problems such as issue N [1] endanger their customers, but endanger non-customers just as much.

[1] [https://wiki.mozilla.org/CA:WoSign_Issues#Issue_N:_Additiona...](https://wiki.mozilla.org/CA:WoSign_Issues#Issue_N:_Additional_Domain_Errors_.28June_2015.29)

</comment></comment></comment><comment><USER78> Corporate personhood is an American thing, but if the CA can't perform their most fundamental function (certifying accurate information), isn't that the best possible case for the corporate death penalty?

A 1-year time-out is insufficient to regain trust, IMO.

I would never let them return, absent some kind of additional (exculpatory) information)

They won't even admit to their behavior!

<comment><USER79> Corporate personhood is _not_ an American thing. It appeared in the UK in the 1800s and it's now common across the world.</comment></comment>


Net Neutrality's Holes in Europe May Offer Peek at Future in U.S - <AUTHOR> https://www.nytimes.com/2017/12/10/business/net-neutrality-europe-fcc.html <comment><USER2> It is quite simple realy. If I pay x€ for y GB/Month, the ISP should not dictate what over the top services I spend that budget on, nor favor its own services (or those of 'partners') by selective exclusion of that traffic from limits that other are held to, or by hindering traffic from the non-partnered services in any way.

Now for the 'complicated' part. In practice it is not difficult to create a situation where everything is degraded. You just under-provision on a choke point. If you then sell alternative routes, or allow edge caches beyond the choke point, you technically didn't 'hinder' any traffic, you just provided such a lousy service to begin with that any not otherwise enabled service provider doesn't stand a chance of offering a decent experience on your network.

But just pointing to a technical situation where it is hard to write a general 'rule' that in any arbitrary case can unequivocally objectively and automatically say whether a certain criterion was fulfilled, and then saying that because it is hard or even impossible to specify the whole regulation should be scrapped, that is disingenuous. The spirit of the regulation can be perfectly fine, even though case-by-case judgement may be required to determine compliance.

Those that will say 'but you can vote with your wallet', I can see where you come from, but the reasoning is flawed. In practice telecoms is not an open market, and many households have near 0 meaningful choice. Strong economic network effects are inherent, and lasting competition has only been present under very strict regulation.

<comment><USER3> Yeah, healthy competition and choice of providers seems like the real solution to me. Solve that and NN doesn't matter, plus you solve a bunch of other problems as well.

NN just feels like a distraction, driven by incredibly manipulative and overhyped propaganda.

<comment><USER4> Deregulatory actions are only ever used in service of entrenching telecom monopolies. The part where we actually get meaningful competition never happens.

Even though I wish for minimal regulation, I can't trust the deregulatory side to provide it. Because that side is infected by people like Ajit Pai who filter out any deregulatory actions which might threaten the monopolists.

<comment><USER5> What additional deregulation would you like to see in the U.S.?

<comment><USER4> For starters: Removal of state and local laws favoring incumbent telecoms over municipal broadband, Google fiber, or other market entrants.

If "deregulation" advocates were actually serious, they would have pursued those actions _first_. Instead, they pick the old telecoms as winners.

<comment><USER5> The majority of states (comprising the vast majority of the population) have little to no restrictions on municipal broadband. Here in Maryland, for example, there is no such law and the governor is actively promoting municipal broadband. But few municipalities are pursuing that option. I'm not aware of any states which have laws "favoring incumbent telecoms over ... Google fiber, or other market entrants." Can you point to anything specific?

> If "deregulation" advocates were actually serious, they would have pursued > those actions first.

They did! Two years before Congress deregulated the industry in 1996, it made it illegal for local governments to grant exclusive cable franchises. Then in the 1996 deregulation, it required non-discriminatory access to utility poles and ducts.

The biggest impediments to deployment these days are at the state and local level: permitting requirements, onerous franchise license terms, etc. Congress could (and in my opinion, should) completely preempt these things, but that's a hard sell. Municipalities use these franchises as a vehicle for all sorts of social agendas ("wire up public buildings!" "wire up disadvantaged neighborhoods!"), and as a revenue source (taxing 5% of gross revenue). Google got most of these things waived in Fiber cities, but it was a move strongly opposed by the public-interest types: [https://techliberation.com/2012/08/07/what-google-fiber- says...](https://techliberation.com/2012/08/07/what-google-fiber-says-about- tech-policy-fiber-rings-fit-deregulatory-hands).

<comment><USER6> Also: [https://motherboard.vice.com/en_us/article/qkvn4x/the-21-law...](https://motherboard.vice.com/en_us/article/qkvn4x/the-21-laws- states-use-to-crush-broadband-competition)

<comment><USER5> Most states, including many of the most populous, New York, Maryland, Massachusetts, New Jersey, Illinois, Georgia, Texas, etc., have no such laws. Many of the states that do have such laws don't have restrictive ones (e.g. in Washington, you just have to be a city with the power to make your own ordinances).

If municipal broadband was something that would actually happen in the absence of these laws, why don't we see these networks popping up in all the places without such laws?

<comment><USER6> There was a question about citing laws, that link cited 21 of them.

Not all cities are building their own internet so that means we don't need to do anything is logic that I just don't follow.

My city didn't build their own. Last time it came up the news reported that it was because Comcast bribed the city council to charge unreasonable fees for adding cables to the existing poles and ensure that only Comcast could do the work on their own schedules. No one disputes that, but everyone who can do anything about it shrugs because Comcast is still paying them and its not illegal because money=speech.

But I guess because some other states with more broadband competition don't have as many restrictions (sense a link there?), and "all the places" that can haven't built their own broadband, I can no longer complain about not having any competition in my market and my leaders are removing laws that protect me from them but instead put in more laws that protect them from me?

<comment><USER5> > Not all cities are building their own internet so that means we don't need > to do anything is logic that I just don't follow.

If you're citing municipal broadband laws as something suppressing the development of competition, it's fair to point out that most people live in states that don't have such laws, yet we don't see municipal broadband emerging as a source of competition in those states.

The U.S. is a big place, and you can probably name _anything_ and find it happening somewhere in the U.S. The question is, what are the things that are actually creating impediments. If states without municipal broadband laws aren't actually building municipal networks, then getting rid of such laws might be a moral victory, but wouldn't actually change anything.

> My city didn't build their own. Last time it came up the news reported that > it was because Comcast bribed the city council to charge unreasonable fees > for adding cables to the existing poles and ensure that only Comcast could > do the work on their own schedules.

Do you have a link to the story? It seems suspect, because pole attachment rates are governed by formulas set by either the FCC, or by the state (if the state certifies that it regulates such rates). Also, most poles are owned by power companies, and they set the rates, not city councils.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> "But the offer alarmed Swedish media companies, which warned that the deal gave Facebook an advantage over competitors, and Telia an edge over other telecom operators."

ISP's have a million and one other ways to be anti-competitive. Example, in New Zealand, one of the major ISP's runs 'Lightbox' a streaming competitor. If you sign up to any of their plans, you get free Lightbox.

This incentives the customer to not use other streaming services. You can talk about zero-rating all day long but no amount of neutrality regulation will prevent something like the example above from happening. What happens if Comcast decides that Hulu Plus will be free with their broadband? It has the same effect as if Comcast decided to zero-rate Hulu on their network.

For their to be real changes in the American ISP market, you need competition.

<comment><USER8> Well...if they are treating all traffic equally then the only advantage the ISP has is bundling. That's a marketing advantage, but not a total competition killer. Amazon bundles streaming with free delivery subscriptions.

Not treating traffic equally would mean they could eliminate Netflix as competition for their customers. That's worse. Same for mail, social networking, news, dating etc. Video is just more pertinent in 2017.

The big thing to protect is always categories that don't exist yet.

Competition helps, but infrastructure markets are always suboptimal.

<comment><USER9> It wouldn't give an ISP advantage over other ISPs, but that doesn't matter because ISPs are for the most part regional monopolies. It would give Hulu Plus an advantage over other streaming video services, though.

</comment></comment></comment><comment><USER10> Besides Pai and the top shareholders of some companies, how many people actually _want_ this proposed repeal?

I'd guess most people don't know or care. Still, millions wrote to object to the proposed repeal.

Is it possible that only a couple hundred people are making this decision for 300 million over the objections of millions?

<comment><USER11> Had a convo in my CS class about it today. Literally a room full of 19-20 something males, many who are avid gamers, or want to make tech it into a job... I was the only one who had anything to say about nn. People really don't know.

<comment><USER12> Perhaps that's because NN has more to do with underhand business tactics than with tech.

</comment></comment></comment><comment><USER13> The article mentions that, _" France has four major mobile and internet operators and nine low-cost offshoots. Britain has more than 50._" I'd appreciate if somebody could explain something here because that doesn't seem to make any economic sense. Let's assume that France/Britain have absolutely rigid and perfectly enforced net neutrality. That means internet service providers can compete only on price/speed as everything else is supposed to be otherwise identical. 13 different companies, let alone 50? How? Users would simply pick the company with the lowest price for their desired speed. And the cheapest service is going to tend to be the largest due to economies of scale. The end result is a natural trend towards monopolization when companies are allowed to only compete on price/speed.

I mean you might decide to pass on a "low-cost" alternative in most industries as there is often an implied "low-quality" qualifier attached. But with strong net neutrality, this is not supposed to be the case. They state a speed, they state a price. Everything else is identical. So what gives? I find it disappointing that the NYT did not even bother to even consider this obvious question since it seems to cut to the core of this issue!

<comment><USER14> We don't have net neutrality, we have competition.

That is the key point, net nuetrality is a moot point because if an ISP were to do something like charge for iplayer (BBC catchup service) which was mooted a few years ago, they'd all move to a different ISP.

Because we have for the moment a roughly open market.

There are parts that are controlled by a monopoly, but thats the people who provide the last mile infrastructure. They have strict regulations saying that they must charge a fixed price for rental of the infrastructure with no obligations other than to pay for the last mile. (they can choose to be a pure virtual operator, just skinning the service, or almost entirely run its own infra, save the last bit of copper)

Also, the people that run the last mile monopoly are not the people providing backhaul. That is mostly an open market too. More open than the last mile copper at least. Linx/lonap are all coops, where you pay a membership fee, and the cost of powering your equipment, any interconnect arrangements are up to you and your peers.

In short, we have a much more open market, but with no net nuetrality.

what america needs is competition, and the seperation of last mile, ISPs and backhaul. None of which you are going to get in present times.

<comment><USER15> Slight clarification: We have an open market explicitly because we have tight last-mile regulation. If we didn't we'd all have local monopolies.

I don't know specifically where you are, but it's true in most of Europe.

<comment><USER5> Some of Europe has tighter last mile regulation, but it's not necessarily better. Take France, for example. France applies unbundling to copper telephone lines and fiber, but not cable. It subsidises fiber backhaul for DSL. Overall, it's got similar fiber deployment to the US (about 10%) but overall much slower speeds (according to Akamai, 11 Mbps average in France versus 19 Mbps in the US). But there is lots of ISP competition in DSL, like there was in the US in the early 2000s. But most people don't have access to faster cable alternatives, because subsidization of the DSL network killed competition.

Is this better?

<comment><USER15> > But most people don't have access to faster cable alternatives, because > subsidization of the DSL network killed competition.

> Is this better?

That's a red herring.

By your own admission this isn't caused by LLUB but by misguided subsidization. It's a deliberate choice of poor example in a pool of much better options.

<comment><USER5> It's a direct byproduct of LLU. LLU eliminates market price signals over the most expensive part of the infrastructure.[1] That requires governments to exercise tremendous discipline in setting the wholesale price. It's politically popular to set the price too low, but that kills investment. France tried to compensate for that through subsidies. But those, predictably, killed the unsubsidized competition.

[1] You obviously can't let the monopoly that owns the loop freely set the wholesale price of the loop.

<comment><USER15> > Government rate setting is such a bad idea, that our oligopolies might be > better. (The US has faster internet than all the big European countries: the > UK, France, Germany, Spain, and Italy.)

And it's slower than Sweden, Norway, Finland, Denmark, and many others.

You can't blanket claim that LLU and rate setting is bad simply by ignoring examples where they work much better than the alternative.

Edit:

You might also want to include consumer prices with that comparison.

I installed fiber (from the street outside) in my house in Sweden and had a pick of 18 ISPs, of which I chose 100/100 Mbit/s for $38/month.

<comment><USER5> (Sorry for the intervening edit.)

Here's Akamai's list of countries with the fastest broadband:

1 South Korea 28.6

2 Norway 23.5

3 Sweden 22.5

4 Hong Kong 21.9

5 Switzerland 21.7

6 Finland 20.5

7 Singapore 20.3

8 Japan 20.2

9 Denmark 20.1

10 United States 18.7

Our presence on this list is remarkable. If you were listing countries with the best of some other kind of infrastructure, say subways, we wouldn't even be sniffing the top 10. Nobody would look at the fact that Sweden or Denmark managed to have good subways and say "well, obviously we can do that too!" And we already know we would do a bad job implementing LLU: it was in the 1996 telecom act, and the FCC set rates too low and killed DSL in the process.

Also, it's not clear what LLU has achieved in a place like say Denmark: [https://erhvervsstyrelsen.dk/sites/default/files/media/publi...](https://erhvervsstyrelsen.dk/sites/default/files/media/publikation/bilag_- _analysis_of_market_structures_in_the_danish_broadband_markets_- _august_2014_-_wik.pdf).

60% of Danish subscribers are with TDC, the privitized former incumbent. TDC must offer DSL access over LLU, but the two companies that do that are Telenor (the Norwegian incumbent) and Telia (the Swedish incumbent). Those three account for 80% of all subscribers. Is this better than our system?

> I installed fiber (from the street outside) in my house in Sweden and had a > pick of 18 ISPs, of which I chose 100/100 Mbit/s for $38/month.

Where I live, I only have two choices for fiber, but 100/100 is $40/month, gigabit is $70-80, and two-gigabit is $150/month. Also: did you or a previous homeowner pay a one-time fee to build the fiber to your house? In the U.S., the ISP usually eats the up-front cost and recovers it in the monthly charge. Finally, U.S. prices include implicit cross subsidies (to build fiber or cable in poorer neighborhoods) that Swedish prices do not.

<comment><USER15> > Besides, Sweden, Norway, Finland, and Denmark either don't impose unbundling > of cable/fiber, or set very high prices for wholesale access: > [http://www.oecd.org/sti/broadband/2-7.pdf](http://www.oecd.org/sti/broadband/2-7.pdf).

I'll go with Sweden as it's the one I know closest. It doesn't... anymore, but it did for maybe 10 years from late 90s, and if Telia (the previously state owned and now privatized incumbent) which has a lot of the FTTH market would start being anti-competitive you can bet regulation will return.

> 60% of Danish subscribers are with TDC, the privitized former incumbent. TDC > must offer DSL access over LLU, but the two companies that do that are > Telenor (the Norwegian incumbent) and Telia (the Swedish incumbent). Those > three account for 80% of all subscribers. Is this better than our system?

Yes? As long as all three has access to all customers (in the US the big ISPs have local monopolies so it's deceiving to look at them as many providers), there's at least some market forces available. But I also think DSL is kind of backwards to look at to begin with.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> In France, the main mobile operator Orange, offers you tethering only as an option to be additionally paid on top of your data plan. They basically monitor the connection to check if your mobile is forwarding packages and do mitm in order to display advertisement about the additional paid option.

<comment><USER17> AT&T USA also charges extra for tethering on top of a data plan. Apple's iPhone will even block you from tethering if you don't pay extra to AT&T.

<comment><USER18> Same with Verizon

<comment><USER19> I'm positive I don't pay an additional charge for tethering on Verizon.

<comment><USER17> You might not given that provider plans and bundles do change over time. Sometimes there are still restrictions and drawbacks (e.g. throttling) since providers are opaque about their services. There could be new plans that include tethering but cost more or have bandwidth caps.

</comment></comment></comment></comment></comment><comment><USER20> I hadn't considered the impacts such a ruling would have on zero ratings schemes, the two hadn't even connected in my mind, but now that it's been mentioned it would clearly fall afoul of any existing regulations. There used to be a similar plan from Optus in Australia to zero rate Facebook, and there's currently one to do the same with Spotify, but today these accompany generous data plans in general, whereas originally it was offered on very low cap plans such as the 100mb/mo plan. Curious to see how this plays out internationally in countries like Aus where this already occurs unchallenged, and whether they will now go further following the ruling in the U.S.

</comment><comment><USER21> My account (US, MN) with Virgin Mobile is already doing this with "free" streaming music. A hand full of apps (Pandora, iHeartRadio, Slacker, 8tracks and Milk Music) don't count towards the monthly data cap.

<comment><USER22> Yep T-Mobile does this as well. There is a way for any streaming music service to put in a request to be added to the list, but I'm not sure if smaller companies get accepted or not.

Edit: There used to be, can't find the link anymore...

</comment></comment><comment><USER2> Outside the wireless space, the local loop is a rather strong classical mono/duo/-poly. While there may be several re-sellers, and more players at the national level, in practice for most individual homes the choices are extremely limited. Network effects (in an economic sense) are in play at the ISP level so entering the mature market as an 'independent' isn't as straightforward as it sounds. Consumer Internet is furthermore already packaged in with a TV/PSTN/Mobile bundle offer. Keeping an open Internet has definitely been a struggle in Europe. One that is under constant attack. A strong Net Neutrality stance has been the only defense, but also over here it is failing as we speak.

<comment><USER23> In Switzerland, some cities have started to break this up, and it's wonderful: Responsibility is split between the local utility and telcos. The utilities are responsible for the last mile (just as they are for power and water), and provide a fiber connection from the customer to one of several points of presence per city. Telcos rent space in these PoPs. They get to skip the expensive last mile and focus on Internet connectivity.

In places where FTTH is available, a wonderful ecosystem of mini-ISPs has sprung up, serving different niches. Some focus on integrated multi-play (Internet/TV/Phone/etc.) setups, others offer affordable quick connections without the bullshit. Choice and competition are alive and well, despite (or because?) part of the infrastructure is publicly funded.

</comment></comment><comment><USER24> >"From a user perspective, I don't think it's a problem and I think most consumers don't think it's an issue," said Magnus Haglunds, a Stockholm-based independent music producer who uses the Telia service. "There are those who may have to change from Apple Music to Spotify. But then they get free surfing on Spotify."

What kind of a sheep customer thinks, "Well I guess I'll just totally change the service I use because that's what my provider wants!" People like that need, if you'll excuse the gendered metaphor, a swift kick in the balls.

</comment><comment><USER25> Call your senators! [https://www.callmycongress.com/](https://www.callmycongress.com/)</comment>


Iran: Even the President Digs Social Media - <AUTHOR> http://techrasa.com/2015/08/30/iran-even-president-digs-social-media/

<comment><USER2> Promotional votes and comments aren't ok on HN. We ban sites and accounts for doing this, so please don't.

We want users to upvote stories that they personally find intellectually interesting, not because they or their friends have something to promote.

</comment><comment><USER3> Wow! the president?</comment>


Teen Prodigy Recognized by Microsoft Now in Critical Condition - <AUTHOR> http://mashable.com/2011/12/30/teen-prodigy-recognized-by-microsoft-now-in-critical-condition/ <comment><USER2> Very sad, did she have a known medical condition?</comment>


AppStore Analysis of 30 Million Downloads - <AUTHOR> http://www.slideshare.net/pinchmedia/iphone-appstore-secrets-pinch-media

<comment><USER2> This is a few months(?) old now. See this presentation from AdWhirl with different conclusions about ad revenue on the iPhone: [http://www.scribd.com/doc/15007502/Adwhirl-iPhone- Advertisin...](http://www.scribd.com/doc/15007502/Adwhirl-iPhone-Advertising- Snapshot)

</comment><comment><USER3> This is some really high quality information. I'm kind of surprised they're willing to give it away. I'm sure people would pay for access to this kind of data.

<comment><USER4> It appears that is exactly what the author (Pinch Media, <http://www.pinchmedia.com/>) offers. At the end of the slides it mentions that they offer these analytics when you sign up for their service.

</comment></comment><comment><USER5> It's 30M, not 300K.</comment>


Ask HN: How to start a startup that requires a high amount of initial capital? - <AUTHOR> I want to start a payments bank in India but it requires a 13M+ USD initial capital just to get the licensing fee.<p>Wondering if people have any examples of how one might cross this barrier to entry. <comment><USER2> There are two ways to answer this question, two new questions basically.

One is "raise over $13m." How? This is not impossible. There is more investor money looking for home today than ever, I reckon. However, this is not a level playing field. Who you are and who you know and how well will make a big difference. This is probably the wrong place for advice about this strategy.

The second possibility is "what is an easier/cheaper idea, that can later become a payment bank?" This is the HN philosophy, from our founder PG.^" Say you had $13,000. What could you build that would get you customers, impress investors or otherwise put you on a less direct _path_ to what you want? Then, you are pitching " _turn this thing into a bank_ " instead of " _start a bank_ " which is a little easier.

This is _hacker_ news so conventional advice here is take on hard engineering problems, and easy business problems. If this was a forum for business people, it'd be the reverse. There, people would rather take the challenge of raising a large sum but avoid hard engineering challenges. You need to figure out what _you_ are strongest at. Are you the kind of person that can cold call your way I to a 7 or 8 figure investment or the kind of person that can build a product in 2 months that will get you investors or customers that will get you to the next step.

Finally, what you are asking is _" how do I succeed at this very hard thing."_ There are no formulas that are easy and will work for most people.

Read this, pay attention to the bridgehead: [http://www.paulgraham.com/ambitious.html](http://www.paulgraham.com/ambitious.html)

<comment><USER3> very good answer ! (ok_hand emoji, 100 emoji)

</comment></comment><comment><USER4> Yeah, I read all these comments and they miss the obvious answer.

Pitch large vcs and ask for a lot of money.

It goes against the YC grain, but it is the reason there are silicon valley vcs. It used to be that starting a company meant building chips and buildings and assembly lines, and some vcs are structured to write 30m series a, 50m total to build product, and then 50 to scale. A friend of mine is doing this in the database world right now.

If there is a 15m regulatory barrier, then your pitch is why your team is the right one to bet on, and you raise 30m. The money is out there, you can take it

<comment><USER5> Are there any concrete examples of these larger scale VC:s and the companies they've funded? The small-fry tech startup is the most familiar story.

<comment><USER6> Pretty much every large tech company you've ever heard of was VC backed originally. Facebook is a recent example with a couple of the VCs putting in 500 million in a later round (see [http://fortune.com/2011/01/11/timeline- where-facebook-got-it...](http://fortune.com/2011/01/11/timeline-where- facebook-got-its-funding/)) Also see more recent examples with fairly capital intensive companies like Uber and Lyft. The odds of getting tens of millions of dollars in the very first round is unlikely. But that's also an unreasonable ask by unproven founders: you'd need to show that you have some clue what you're doing with smaller amounts in the earlier rounds... Apple got <$1m from their first investor.

</comment></comment></comment><comment><USER7> Partner with a bank.

Or get a hedge fund to buy a bank shell, have it as an asset, and use that bank. If your startup fails, they still have the asset.

Or you may just need to have access to 13M, it's probably not the fee. So - you can just borrow 13M and use the 13M as collatoral. If you structure the deal right, it's 100% risk free. Moreover, you may be able to invest the 13M in which case you can still return an interest rate.

So you could find a fund with 13M, draw up the paperwork such that they put that in your company, but it can't be spent, and the 13M is effectively it's own collateral. Then pay the investors interest, plus some small coupon payment, or give them some equity for their risk free investment.

So long as the paid up capital isn't used for anything, it's a 'non transaction', i.e. it has no financial meaning.

That said, the 13M may be designated as collateral or some kind of requirement for the payments system.

<comment><USER8> > So - you can just borrow 13M and use the 13M as collatoral

wouldn't OP need equivalent collateral to borrow 13M even?

<comment><USER9> No, because he isn't spending the money. He borrows 13M, and then the 13M just sits in an account, doing nothing, or earning say, the risk-free rate. There's no risk for the lender, because the money isn't going anywhere.

<comment><USER10> Except if the money gets used for reimbursements/damages that the new startup bank has to pay if it's mismanaged --- that is one of the reasons the money needs to be there, I assume.

</comment></comment></comment></comment><comment><USER11> I have thought about this myself.

I am from Africa and needless to say, we don't have an abundance of VC funds for startups.

I have used products live Revolut and Monzo before and loved them, there is an opportunity being missed in places like Africa and other developing economies that have a huge growing youthful middle class that hates the way the established banks operate and is comfortable with technology.

I spent most of my free time last year building a backend that can handle some core banking functions, I already did research on the licensing and knew I would never be able to raise that money just with an idea and business plan so to keep myself going and also have something to show potential VC's I decided to start small, things like airtime top-up, bill payments etc

Break it down , look at the bits that you can build out and get some initial customers while you look to raise money, you don't have to go all out and build a whole bank, start small, licensing for things like e-wallets and money transfer is not unreasonably expensive, you can then go on to build on top of that

Good luck.

<comment><AUTHOR> We are in the same boat. Are you from Africa but working in London/Europe? I am from India but I am working in London.

I have identified millennials to be my main market as well. In India whenever I visited the bank with my father, the person at the bank would try to sell a new card. They always want to "sell" you something, we just have to suck less as a digital bank and the millenials will happily help us get rid of the traditional banks. I've discussed Monzo with a lot of friends, and they have loved the idea.

Curious, what part of Africa are you from? What is the cost of the banking license like there?

</comment></comment><comment><USER12> Check out Monzo in the UK. They started as a top up payment card with great technology. This meant they didn't need a banking license. They are now moving into the current/checking account space with a license.

So do you need a license from the start? Impossible to tell from your comment.

<comment><AUTHOR> The idea is heavily borrowed from Monzo. A Payment Bank in India seemed like the closest thing to what Monzo did initially. A full banking license requires 5 times more capital than a payment bank.

That is a good question. I'll see if I can still issue cards that links to one real bank account and if we can bypass being a payment bank.

<comment><USER13> You can re-issue international debit cards and sell them. The vendor will give you API and you build the interface. If you can convert local indian currency to USD, then it can work for you. From there, you get traction and then ask investors for cash.

<comment><AUTHOR> I'll look at this. I didn't think of this, I am a little skeptic about Reserve Bank of India allowing this. Thanks for the lead.

</comment></comment></comment></comment><comment><USER14> I know a bunch of people here have said "partner with a bank" or get a license. That seems like a good option, but obviously you wonder how can a small startup or even a founder or two do that?

I have learned a couple things about being the little guy trying to partner with bigger folks:

\- Josh Elman (from Greylock) suggested that when (I think) when LinkedIn (or Twitter, I forget) was small, they didn't go out to look for partnerships with big companies, because they knew those wouldn't pan out because no one in a big company would care. They mostly sought relationships with smaller companies with some audience, but who were more receptive to talk to team up to crush the big guys and offer better value. Smaller competitors in crowded markets like banking are always trying to find ways to become more dominant, so they are more open than the folks at the top of the market.

\- Just make your offering really really compelling - the "offer you cannot refuse" kind. This is not easy. This goes against traditional business sense, because you might have to offer value at less than cost. But if this is what the existence or growth of your business hinges on, you have to bend over backwards. Goes to the good old Dale Carnegie stuff; focus on their value in the conversation over yours. They need to feel like working with you is a steal of a deal. There are plenty of ways and business models to do this, but offering human capital, co-branding, offering equity or some rev share, customer insights, etc. are all fair game.

<comment><AUTHOR> Josh Elmans advice is really great advice. I'll try to contact the smaller banks that don't have a lot of debit card sales.

Coming up with an "offer you cannot refuse" feels a little tough given its just the too of us wanting to do this after working for one year after University.

</comment></comment><comment><USER15> Start smaller. Most of the disrupter banks started as something else with the view to eventually obtaining a banking license. That way you can actually prove that you have a product worth investing in. Usually banking startups start with a Stored Value Facility license (or the local equivalent) and work up from there.

<comment><USER16> Seconded. Start smaller. The simple concept to remember is: if you need $13M to start this business, it's a business you can't start right now; it's instead an opportunity for larger businesses.

We had a similar problem: we started with "let's build the city of the future", which would have probably required a large capital (of course, we wouldn't have done it alone, but still...), and ended up focusing on creating innovation at the financial layer of real estate, which we started with a few 100,000s of $$.

Doing good so far.

<comment><AUTHOR> "The simple concept to remember is: if you need $13M to start this business, it's a business you can't start right now; it's instead an opportunity for larger businesses"

True. I should look at the smallest thing that I can do that can provide value and that can somehow pivot into a bank.

Good luck with your startup :)

</comment></comment></comment><comment><USER17> This isn't the sort of thing to do as a cold startup. The way to do this is what is sometimes called "intrapreneur", as a "startup" within an existing large corporation that can bankroll such a large project.

Are you an engineer, or a banker? If you don't have a track record in the banking industry, you're hosed. No one will give you that kind of money. If you've actually been there for the founding of a bank before, then maybe. Moreover, if you're an engineer without banking experience, you probably have _no idea_ what you're getting yourself into.

</comment><comment><USER18> Can you finance the license fee? Ie borrow to get it, and if all doesn't work out, the corporation goes bankrupt? Or can you lobby the issuing agency to give you a payment plan?

My only concern with such a large investment is that at the beginning you don't know what you don't know. You think $13m is a big problem, wait till you have that license and uncover all the reasons why people with $13m in their pocket have avoided the problem you're trying to solve (just a maybe, but I'm sure there are other problems you'll encounter you should look to resolve before you try dump so much money on a business).

</comment><comment><USER19> The fix has two steps:

1) Bring in co-founders whom raised $100m+ from VCs in companies they were in before. Also, one of those companies needed to have had an exit where it was very profitable for those VCs. Getting these co-founders is hard, but it is your fix. One of them needs to have been the CEO of the former successful exit.

2) Use $500k in capital to build the pre-launch version. Be hyper-capital efficient building the tech, for demos to investors. Bring the product working to investors along with those co-founders as part of the team.

Make sure those co-founders confirm that they think they can raise the capital in this business model.

</comment><comment><USER20> There is a reason requirements to start a bank are so high. Banking is a really hard business and you margins are not that great. There is so much regulation that your licensing fee will look like small potatoes.

Instead you should ask if there is cheaper way to get to where you want to be. You could start by researching how the PayTM guys did it.

<comment><AUTHOR> The PayTM guys really took off with demonetization and they really rode the wallet wave.

</comment></comment><comment><USER21> It is critical to minimize the risk. Remember, you are taking somebody's money. Their main concern will be the payout and this is the likelihood of future income minus risk of losses. You probably spent some time thinking of future income (everybody does), now do your homework and work hard how to mitigate risks. With lower risks you can ask for more money for less stake in your budding enterprise.

With large amounts of money involved there will be more focus on risks involved and so it gets critical.

</comment><comment><USER22> Lots of crazy answers here.

As an industry insider, what you do is buy a bond from a company that specializes in these sorts of licensing bonds. It should only cost you a small fraction of the capitalization requirement each year to maintain.

<comment><AUTHOR> Another unique suggestion that I couldn't possibly think of. I'm really overwhelmed by the response I got to this thread. I'll look into this.

<comment><USER22> The capitalization requirement doesn't exist to make it an exclusive club. It makes it so the potential regulatory fines have teeth because you can't just fold on the first one received.

The bank offers to cover your fines (with your entire business as collateral), for a fee. You can think of hat fee as the interest rate on a loan, which it basically is because the money is put into an escrow account with the government.

In my own market it was $10M usd required to become a payment services provider (e.g. Venmo). But you could get someone to offer the bond for a few hundred thousand dollars a year, the price depending on how comfortable they were with you and your business. That's within the realm of doable for a startup.

</comment></comment></comment><comment><USER23> Find a smaller problem to solve that would require less capital and prove that you're worthy of $13M.

You can likely do what you want by partnering.

</comment><comment><USER24> we are a lending startup in India - also a YC alumni (RedCarpetUp YC S15).

We are (now) a regulated entity with specific licenses that took us a crazy amount of time from the Reserve Bank of India.

Two things - first, the business models of payment banks is kind of unproven. Those of us who are in the fintech space in India kind of agree that the regulators kind of screwed up here. I'm hoping you have answers to that. TL;DR - a payment bank cannot lend.

Second, the regulatory structures in India are setup to look at license grants not as a consequence of capital. Even if you had a 100 million USD (and I know of specific examples here), there is very less likelihood of you getting a payment bank license unless you can prove out a gold standard team and board experience. Just to remind you, bank CEOs in India are appointed by the Reserve Bank. They are NOT appointed by founders or investors. One of the CEOs of a very large bank in India just got fired by the regulators for dancing around stockholding regulations - [https://economictimes.indiatimes.com/industry/banking/financ...](https://economictimes.indiatimes.com/industry/banking/finance/banking/oh- yes-you-lost-your-ceo-for-greater-good-why-rbi-said-no-to-a-full-term-for- rana-kapoor/articleshow/65881229.cms)

I feel there is a very low chance of you getting regulatory clearance for this. Indeed, we give out a t-shirt that says "Because, its regulatory" to fresh employees at RedCarpet ! We are tech founders, but we have spent countless hours sitting outside RBI doors trying to make case for several regulatory changes. We were one of the first to get license grants for non- standard lending risk policies to the unbanked in India (that's a billion people!).

Write to me [http://scr.im/redcarpetup](http://scr.im/redcarpetup) if you want to come work with us for a while. Maybe you will stay a while and listen to stories of regulatory pacman in India.

<comment><USER25> I would do a prepaid visa or something.

<comment><USER24> prepaid instruments in India are regulated. Beyond a certain limit you need to do a full KYC. Issuing a prepaid/wallet needs a license with fairly high capital and regulatory requirements (in the same order of magnitude as the payments bank).

You can issue a card in partnership with a bank or another license holder, but as i said before - in that case you better have a business model for that, because you aint gonna make money from MDR or anything.

</comment></comment></comment><comment><USER26> You can raise a lot of money at the beginning if the founders have the right connections and track record. Opendoor was able to raise a $10M Series A without a product. [0]

[0] [https://techcrunch.com/2014/07/07/opendoor/](https://techcrunch.com/2014/07/07/opendoor/)

</comment><comment><USER27> The high-entry barrier business is where VC actually makes sense. Building a webapp and getting $3M VC money is a little bit of a waste. Building a rocket or a jet requires $100M and there's no other way around it. You're maybe somewhere in between. Or start small. Maybe in a different country/province, if you can.

</comment><comment><USER28> Like someone said, partner with a bank. Maybe check with RBL bank, they even have API for virtual accounts ([https://developer.rblbank.com/content/virtual- account-api](https://developer.rblbank.com/content/virtual-account-api)).

</comment><comment><USER29> Do something in the banking ecosystem to get your foot in the door.

What I have noticed in Malaysia are startups effectively handling the {credit card, loan, insurance} applications & such other Web forms that banks are far too incompetent to do effectively.

Once you do this well, you will be on the right path.

</comment><comment><USER30> I have similar question too. The initial Capital investment for Storage and Trucks along with Ordering and Distribution Software for a Food Distribution business requires up to $2M+ USD Capital. ( It is consider a large sum in Hong Kong, which has a slightly smaller TAM than say US or China ) While I can guarantee we reach $1M USD monthly revenue within the first 12 months, I have yet to find anyone interested in funding.

If anyone could give any tips or help send me a email.

my username @live.hk

</comment><comment><USER31> Have you considered starting a payments bank in another country where you can prove your idea with less capital? Then you can use the capital from that to get started in India or if there's not enough, you can use the experience to inspire investments to get the capital.

Also, I hope you're ready for an immense amount of red tape.

<comment><AUTHOR> I have had the idea of looking at other countries before but I haven't put in time to figure out what countries I should be looking at. Will look into this.

</comment></comment><comment><USER32> From what I've seen, your expertise and network in the field are what will allow you to raise funds for a capital intensive business.

If you don't already know people and/or have deep expertise in the field, why would someone give you the money?

</comment><comment><USER33> My thought here has already been said. Start smaller if you can. I'm starting really small with one specific banking issue and the entry fees are much smaller. I'm using some hedge fund ideas to get the capital.

</comment><comment><USER34> Start a software startup and sell it and use the funds to start this one. Simple!

</comment><comment><USER35> Consumer or Enterprise? If it's the latter, get a list of customers who will put in (can be legally non-binding) writing, "If you build X it is worth Y to me." Get enough of those and take it to a VC.

</comment><comment><USER36> A team with multiple big exits could possibly raise the money from VCs or self-fund.

More likely, something like this would start inside another company or it would partner with a license holder at first.

</comment><comment><USER37> I have looked into this area. The best way to do it is to partner with an existing bank. You wouldn't need payment processor license which would likely be very costly.

<comment><USER37> Must say its a difficult task to convince banks to partner with you.

<comment><USER37> In Pakistan, Finja did the same. [http://www.finca.pk/news/finca-launches- pakistans-first-ever...](http://www.finca.pk/news/finca-launches-pakistans- first-ever-digital-wallet/)

</comment></comment></comment><comment><USER38> Have you considered opening a cooperative Bank? You could out-innovate a lot of slow moving small banks. And I think the initial capital requirements are lower.

</comment><comment><USER39> well one way to 'hack' your way to bankdom is through founding a company offering sketchy financial advice then expanding to sketchier insurances and payday lending, then to banking. takes about 25 years and you get to be public enemy number one doing this. they 'sadly' went under during the crisis though.

because its so difficult most banks are very old and most new ones are established by existing players.

</comment><comment><USER40> You work with an existing bank. Many examples of fintech startups that started like only getting a banking license much later.

</comment><comment><USER41> Hey! I'm interested in this goal too. Fancy a talk? Email/twitter is in bio.

</comment><comment><USER42> You convince an investor to fund you with research (aka expertise)

</comment><comment><USER43> Can you buy an existing bank that is already licensed?

<comment><USER44> Still gonna cost more than that $13MM, since that's the asset people are after.

</comment></comment><comment><USER45> you can rent a licence, there are many banks doing that in EU. I think you need to do a better research..

<comment><USER46> Can you expand on this? Never heard of this but I'm not super involved in fintech/banking. Something like Solarisbank?

<comment><USER47> Not OP, but here's generally how you would do it [0].

However, in the EU there are a few other banks to try [1], [2].

In the US, you could try [3].

There's also companies which partner with multiple banking services to provide a cohesive offering [4], [5].

For anyone wanting to do this, here's two issues that I have found.

1) If you don't have banking licenses, the conversation will stop abruptly. Even if they advertise that they may work with you from their website. It's a big hurdle.

To overcome that, I know of 1 company that may help [6]. If anyone knows of any more, please reply.

2) It's rare to talk to VP/Management level operatives, which is where you want to be. Unless you manage to dig out the CEO/COO email and contact them directly. Going from the bottom (contact us form) upwards just means you'll end up speaking to a Z level employee who doesn't know the banking business at all.

Disclaimer: I've contacted over 100 fintech companies. The whole state of affairs is pretty bad. It's improving, but won't be there until 2020 at least.

[0]: [https://blog.faisalkhan.com/money-transmitter-license- applic...](https://blog.faisalkhan.com/money-transmitter-license- application-d9dd32286871)

[1]: [https://www.fidor.com](https://www.fidor.com)

[2]: [https://www.mambu.com](https://www.mambu.com)

[3]: [https://www.crossriverbank.com](https://www.crossriverbank.com)

[4]: [https://www.railsbank.com](https://www.railsbank.com)

[5]: [https://www.unnax.com](https://www.unnax.com)

[6]: [https://www.coinx.com](https://www.coinx.com)

<comment><USER46> Wow, you know I am always blown away by how helpful people are and how awesome responses can be. I really appreciate this and all the resources, I'm reaching out to Fidor today to learn more

</comment></comment></comment></comment><comment><USER48> don't

</comment><comment><USER49> adplexity.com - 5 million USD revenue.

Better launch a new product first, make revenue like the product i posted and use that money to fund your big business.

</comment><comment><USER50> I know it's not popular around here, but have you considered getting traditional business loans from a bank?

</comment><comment><USER51> the barrier is there to stop instances like this.

<comment><USER52> That's uncharitable.

Here in Australia there is a team building a new bank and having good success doing so. In order to overcome the institutional barriers like the one the OP raised, the team consists both of highly experienced corporate "grey hairs" and talented young hackers/designers.

This way, they have the industry experience and network to ensure the company is run competently and prudently, whilst also being able to leverage the energy and creativity of younger hacker-types who can bring new ideas to the market.

I'd suggest to the OP that this kind of approach may work for them.

</comment></comment><comment><USER53> You just do it

</comment><comment><USER54> You could try crowdfunding, but I can't for the life of me remember the name of the website. "Kick"-something.

</comment><comment><USER55> Crowdfunding might be an option if everything else fails. However, it's highly dependent on your network and social visibility.

</comment><comment><USER56> Disruption. Begging for forgiveness instead of asking for permission. You can see it in many major players that got their start by going around regulations.

Once you are onto something, the regulations can be satisfied by backers who see a business plan, cashflow from the side of the business, or perhaps new regulations will form around the new company's business model.

<comment><USER7> No.

There is no way around this kind of regulation, and they definitely are not going to 'change their minds' once they see someone has broken it. They're going to put someone in jail.</comment></comment>


Amazon Web Services: New Release of ElasticFox - <AUTHOR> http://aws.typepad.com/aws/2008/04/new-release-of.html

<comment><USER2> That looks absolutely great. Going to have to download now.

</comment><comment><USER3> makes ec2 so much easier to use!</comment>


Darpa Looking for Underground Facilities - <AUTHOR> https://twitter.com/DARPA/status/1166736432901308416 <comment><USER2> It's for practice space for the Subterranean Challenge [1], before the secret project speculation starts =P

[1] [https://www.subtchallenge.com/](https://www.subtchallenge.com/)

<comment><USER3> That or an asteroid.</comment></comment>