CA Comodo used broken OCR and issued certificates to the wrong people

Re:CA Comodo used broken OCR and issued certificates to the ... by bandrami on Friday October 21, 2016 @12:51PM (#12762070)

Just like you do with ssh: you ask the site administrator.

Now, if you have a CA who gives out certificates to parties who should not have them, and that CA can sign certificates for any domain, how do you know if any connection is a MiTM or benign? Do you actually check the issuer every time you connect to a secure site?

CAs give a false sense of security. We need to move off this model.

[ Parent | on HN ]

Re:CA Comodo used broken OCR and issued certificates to the ... by icebraining on Friday October 21, 2016 @07:15PM (#12765727)

Just like you do with ssh: you ask the site administrator.

How?

CAs give a false sense of security. We need to move off this model.

Maybe, but not by adopting the politician's syllogism. We should only move to a better model. As easy as it may be, it's still slightly harder to get a CA to sign a cert for a domain you don't control than it is to sign them yourself, and that shouldn't be dismissed.

[ Parent | on HN ]