News for hackers. Stuff that matters.

A comment on China Internet Network Information Center accepted as a Mozilla root CA. Parent comment

Re:China Internet Network Information Center accepted as a M... by cperciva on Tuesday February 02, 2010 @11:03AM (#1095162)
There will be documentary evidence if a nation-state actor uses a bogus SSL certificate, yes. Whether anyone will keep said evidence -- do you keep long-term copies of every SSL certificate you see for www.google.com? -- is a different matter, especially since a smart attacker (which we presume nation-state actors are) is likely to be selective in their targets.
[ Parent | on HN ]
Re:China Internet Network Information Center accepted as a M... by __david__ on Tuesday February 02, 2010 @02:09PM (#1095726)
It would be nice if Firefox kept track of certs and notified you of changes (like ssh) regardless of them being signed by a CA or not. Especially if servers made their certs continuous (ie, signing the new one with the old one), in which case it would only warn on discontinuous cert changes.
[ Parent | on HN ]
Re:China Internet Network Information Center accepted as a M... by insulanus on Wednesday February 03, 2010 @01:06PM (#1098370)
Yes, this tool should be on by default:

https://addons.mozilla.org/en-US/firefox/addon/6415

[ Parent | on HN ]