News for hackers. Stuff that matters.

A comment on Apple's response to the WoSign incidents. Parent comment

Re:Apple's response to the WoSign incidents by Tinyyy on Saturday October 01, 2016 @12:49PM (#12618668)
I’m just curious, what standards did they violate other than circumventing SHA-1 deprecation?
[ Parent | on HN ]
Re:Apple's response to the WoSign incidents by pfg on Saturday October 01, 2016 @12:52PM (#12618685)
A number of issues can be found here[1]. Among other things, they allowed domain validation on unprivileged ports and issued certificates for "parent" domains when subscribers were able to validate control of a subdomain (i.e. you could get a certificate for github.com by controlling user.github.com).

[1]: https://wiki.mozilla.org/CA:WoSign_Issues

[ Parent | on HN ]