An update on attempted man-in-the-middle attacks

Re:An update on attempted man-in-the-middle attacks by stanleydrew on Tuesday August 30, 2011 @02:32AM (#2940370)

It's heartening but it's also not. Surely there have been many other cases of invalid certs being granted for lower profile sites, perhaps by this very same CA, without any of us ever hearing about it. And surely the granter of one of those is still considered valid within many browser/OS configurations. But because this was an invalid Google cert the CA gets shut down.

It kind of highlights the difficult problem of when to decide to blacklist a CA in the current model.

And for clarity, who/what do you think is the real power behind Internet trust? I've been thinking about it for five minutes and can't come up with a good answer.

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by thurn on Tuesday August 30, 2011 @02:39AM (#2940387)

Browser vendors, perhaps?

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by wisty on Tuesday August 30, 2011 @05:09AM (#2940658)

And OS vendors. And whoever configures the computer. You buy a computer that was made in China, and it has root certs already in there (thanks to either Microsoft or Apple, or the shop who sold it, or the guys who assembled it - who knows?). Chome / Safari uses the system certs. All good, right?

[ Parent | on HN ]

Re:An update on attempted man-in-the-middle attacks by rhizome on Tuesday August 30, 2011 @04:42AM (#2940610)

who/what do you think is the real power behind Internet trust

Nobody, it's all fiat. Verisign started this scam and we're just seeing the follow-on effects. There has never been anything more than the words and policies supporting the CA industry.

[ Parent | on HN ]