News for hackers. Stuff that matters.

A comment on CA Comodo used broken OCR and issued certificates to the wrong people. Parent comment

Re:CA Comodo used broken OCR and issued certificates to the ... by Pyxl101 on Friday October 21, 2016 @06:42PM (#12765544)
There is an accusation in the comment thread of the article that Comodo only disclosed this issue to Mozilla after it was reported publicly by the news media.

> steffen 2016-10-20 08:35:58 PDT

> In fact, the linked incident report refers to the heise article I also linked. So Comodo chose to "publish" this immediately after it was made public by others. That would be quite a coincidence. This raises the question of whether Comodo would've informed Mozilla at all if the media hadn't picked up on it.

[ Parent | on HN ]
Re:CA Comodo used broken OCR and issued certificates to the ... by dfeart3453465uf on Friday October 21, 2016 @07:50PM (#12765959)
A lone security researcher can find a bug and write it and share up a lot more quickly than corporation.

Corp has to write, test, verify, share internally, review and approve before it can be released. Bureaucracy. They also needed to patch their systems too.

Ryan Sleevi (Google) asked the question, and Robin Alden (Comodo) stated a reasonable timeline. There is no conspiracy here.

[ Parent | on HN ]