News for hackers. Stuff that matters.

A comment on Improved Digital Certificate Security. Parent comment

Re:Improved Digital Certificate Security by MichaelGG on Sunday September 20, 2015 @05:14AM (#10246989)
Can you point to USG or Chinese CAs that publicly mis-issued or used certs? CNNIC comes to mind and they've been removed. Which others were you thinking about?
[ Parent | on HN ]
Re:Improved Digital Certificate Security by jMyles on Sunday September 20, 2015 @10:52AM (#10247710)
I'm not aware of any; I was just referring to the evident more general contempt for security.
[ Parent | on HN ]
Re:Improved Digital Certificate Security by MichaelGG on Sunday September 20, 2015 @04:06PM (#10248846)
In other words, no USG or remaining China CA has violated the CA guidelines and requirements publicly.
[ Parent | on HN ]
Re:Improved Digital Certificate Security by jMyles on Sunday September 20, 2015 @04:41PM (#10249017)
I'm not sure what you are suggesting - that the CA guidelines need to be changed? Instead of the CA system being scrapped?
[ Parent | on HN ]
Re:Improved Digital Certificate Security by andreyf on Sunday September 20, 2015 @11:48AM (#10247936)
CNNIC did not mis-use or mis-issue certs, but issued a cert to an Egyptian company which mis-used it, iirc.
[ Parent | on HN ]
Re:Improved Digital Certificate Security by MichaelGG on Sunday September 20, 2015 @03:47PM (#10248760)
Uh, issuing a CA cert to the Egyptian company was the very definition of mis-issuing a cert!
[ Parent | on HN ]
Re:Improved Digital Certificate Security by andreyf on Tuesday September 22, 2015 @01:30PM (#10260165)
No, the definition of mis-issuing a cert is when you issue a Google cert to someone who isn't Google. Not doing due diligence on what people to whom you've issued a cert are doing with it is a little different.

This is just semantics, though. I think everyone agrees they done bad.

[ Parent | on HN ]