News for hackers. Stuff that matters.

A comment on Distrusting New WoSign and StartCom Certificates. Parent comment

Re:Distrusting New WoSign and StartCom Certificates by pfg on Tuesday October 25, 2016 @10:05AM (#12788070)
IIRC they were revoked in the course of the investigation (somewhere in the last two months).

That being said, the risky bit is that they actually signed those SHA-1 certificates in the first place - a certificate that could be specially crafted to "collide" with one for a site an attacker wants to impersonate. It's not really all that important whether they're revoked (though there's nothing wrong with revoking them just in case).

As for CAs being the weak point, luckily we're going to be living in a mandatory Certificate Transparency world in the not-so-far future.

[ Parent | on HN ]
Re:Distrusting New WoSign and StartCom Certificates by bandrami on Tuesday October 25, 2016 @10:20AM (#12788191)
IDK, I'm worried this is an example of what that will look like: since the CAs are the actual stakeholders, the default question is going to be "what can we do to make this CA trustworthy again?" rather than "how can we make sure this CA never has another cert trusted again?"
[ Parent | on HN ]