News for hackers. Stuff that matters.

A comment on Apple's response to the WoSign incidents. Parent comment

Re:Apple's response to the WoSign incidents by justinclift on Saturday October 01, 2016 @03:57PM (#12619625)
Good point, that might be the better solution for the public HTTPS part of things.

Lets Encrypt doesn't provide MS Authenticode signing certs (eg to validate our downloads are legit) though. Hopefully this whole mess doesn't scope creep to include those too.

[ Parent | on HN ]
Re:Apple's response to the WoSign incidents by marcosdumay on Saturday October 01, 2016 @05:02PM (#12619862)
You bet it will. If MS does not revoke them, it will reflect very badly on the security of their program.
[ Parent | on HN ]
Re:Apple's response to the WoSign incidents by duskwuff on Saturday October 01, 2016 @05:11PM (#12619897)
If anything, I'd expect code signing certificates to be at more risk. Usage of these certificates is inherently much more difficult to track, as signed executables are much harder to discover than web servers. As such, even if there were a "certificate transparency" process for code signing certificates (which I don't believe there is), it'd be difficult to prove it was being operated honestly.
[ Parent | on HN ]