News for hackers. Stuff that matters.

A comment on Around 293 intermediate CAs in violation of CA/Browser guidelines. Parent comment

Re:Around 293 intermediate CAs in violation of CA/Browser gu... by parliament32 on Monday July 06, 2020 @12:30PM (#23749543)
Doesn't this just shift the exact same trust to registrars?
[ Parent | on HN ]
Re:Around 293 intermediate CAs in violation of CA/Browser gu... by ocdtrekkie on Monday July 06, 2020 @12:40PM (#23749652)
It shifts the trust to a single CA instead of all the CAs.
[ Parent | on HN ]
Re:Around 293 intermediate CAs in violation of CA/Browser gu... by a1369209993 on Monday July 06, 2020 @02:29PM (#23751079)
More precicely, it means that compromising the public key infrastructure requires compromising one specific CA, rather than compromising any single CA out of hundreds. Ideally, we would it to instead require compromising all CAs out of hundreds, but as long as the defective-by-design X.509 PKI is used, that's not very possible, much less likely.
[ Parent | on HN ]