News for hackers. Stuff that matters.

A comment on Improved Digital Certificate Security. Parent comment

Re:Improved Digital Certificate Security by isomorphic on Sunday September 20, 2015 @02:01AM (#10246704)
If it was leaked externally, it'd be more than just pissing off Google, it'd be justification for removing Symantec's CA certs from browsers. I.e., who knows what other domains Symantec might be "testing" that would go undiscovered because the owners of those domains don't have Google's resources.

But as the other poster says, this probably wasn't leaked at all.

[ Parent | on HN ]
Re:Improved Digital Certificate Security by jMyles on Sunday September 20, 2015 @02:45AM (#10246767)
> it'd be justification for removing Symantec's CA certs from browsers

More than half of the CAs have publicly violated trust at some point. The governments of the US and China, who are arguably the biggest threats to HTTPS, still have CAs.

While I agree with you wholeheartedly, it doesn't look like either incompetence or malice vis a vis security are substantial enough justifications for the browser makers to pull the plugs here.

[ Parent | on HN ]
Re:Improved Digital Certificate Security by MichaelGG on Sunday September 20, 2015 @05:14AM (#10246989)
Can you point to USG or Chinese CAs that publicly mis-issued or used certs? CNNIC comes to mind and they've been removed. Which others were you thinking about?
[ Parent | on HN ]
Re:Improved Digital Certificate Security by jMyles on Sunday September 20, 2015 @10:52AM (#10247710)
I'm not aware of any; I was just referring to the evident more general contempt for security.
[ Parent | on HN ]
Re:Improved Digital Certificate Security by MichaelGG on Sunday September 20, 2015 @04:06PM (#10248846)
In other words, no USG or remaining China CA has violated the CA guidelines and requirements publicly.
[ Parent | on HN ]
Re:Improved Digital Certificate Security by jMyles on Sunday September 20, 2015 @04:41PM (#10249017)
I'm not sure what you are suggesting - that the CA guidelines need to be changed? Instead of the CA system being scrapped?
[ Parent | on HN ]
Re:Improved Digital Certificate Security by andreyf on Sunday September 20, 2015 @11:48AM (#10247936)
CNNIC did not mis-use or mis-issue certs, but issued a cert to an Egyptian company which mis-used it, iirc.
[ Parent | on HN ]
Re:Improved Digital Certificate Security by MichaelGG on Sunday September 20, 2015 @03:47PM (#10248760)
Uh, issuing a CA cert to the Egyptian company was the very definition of mis-issuing a cert!
[ Parent | on HN ]
Re:Improved Digital Certificate Security by andreyf on Tuesday September 22, 2015 @01:30PM (#10260165)
No, the definition of mis-issuing a cert is when you issue a Google cert to someone who isn't Google. Not doing due diligence on what people to whom you've issued a cert are doing with it is a little different.

This is just semantics, though. I think everyone agrees they done bad.

[ Parent | on HN ]