An update on attempted man-in-the-middle attacks

Re:An update on attempted man-in-the-middle attacks by SoftwarePatent on Tuesday August 30, 2011 @01:34AM (#2940254)

Ouch, DigiNotar is revoked in Chrome? They didn't do anything wrong, someone else pretended to be them.

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by pilif on Tuesday August 30, 2011 @01:37AM (#2940266)

For somebody else to pretend to be then, in this case, they need their private key. As a CA, you can't have your private key leaked and then still be trusted by a browser.

Or they issued the *.google.com certificate by accident, but if you accidentally issue a certificate as a CA, you can't be trusted by a browser either.

IMHO, this was entirely justified.

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by tptacek on Tuesday August 30, 2011 @01:46AM (#2940280)

They're being revoked in Firefox and IE too. Their certs are hopefully going to be worthless soon. The ONE THING you ask a CA to do is NOT LET ITS PRIVATE KEY BE USED FOR EVIL. ONE THING.

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by birken on Tuesday August 30, 2011 @01:38AM (#2940271)

The only way this attack would have worked is if DigiNotar's private key, whose public key is included in the major CA whitelist in major browsers, signed the domain. So either they did it, or somebody stole their private key. Either way it is very much their responsibility.

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by sid0 on Tuesday August 30, 2011 @02:06AM (#2940319)

And Mozilla products and apparently IE. Serves them right. I hope every time such a thing happens the CA gets kicked out and blacklisted for life.

[ Parent | on HN ]