Re:China Internet Network Information Center accepted as a M...
by cperciva on Tuesday February 02, 2010 @11:03AM
(#1095162)
There will be documentary evidence if a nation-state actor uses a bogus SSL certificate, yes. Whether anyone will keep said evidence -- do you keep long-term copies of every SSL certificate you see for www.google.com? -- is a different matter, especially since a smart attacker (which we presume nation-state actors are) is likely to be selective in their targets.
Re:China Internet Network Information Center accepted as a M...
by __david__ on Tuesday February 02, 2010 @02:09PM
(#1095726)
It would be nice if Firefox kept track of certs and notified you of changes (like ssh) regardless of them being signed by a CA or not. Especially if servers made their certs continuous (ie, signing the new one with the old one), in which case it would only warn on discontinuous cert changes.
I'm more than a little leery about this, but at least if there is a security breach due to this, it should be traceable, right? I mean, if a CA signs a faulty certificate, their signature is part of the certificate, so it should be traceable. So, without any evidence of wrongdoing, how are they any worse than Verisign? Or any of the cheap SSL certificate providers? It's not like the CNNIC is going out of business anytime soon.