Web browsers drop mysterious company with ties to U.S. military contractor

Re:Web browsers drop mysterious company with ties to U.S. mi... by charleyablaze on Thursday December 01, 2022 @06:11AM (#33814844)

I agree there was a lot of mud slinging in that thread, but this is the key bit from Mozilla's response, supported by statements which Trustcor haven't disagreed with:

> Certificate Authorities have highly trusted roles in the internet ecosystem and it is unacceptable for a CA to be closely tied, through ownership and operation, to a company engaged in the distribution of malware. Trustcor’s responses via their Vice President of CA operations further substantiates the factual basis for Mozilla’s concerns.

It's not some other company, its the same owners and operators doing malware under one name and running a CA under another.

[ Parent | on HN ]

Re:Web browsers drop mysterious company with ties to U.S. mi... by irthomasthomas on Thursday December 01, 2022 @06:24AM (#33814926)

The most shocking aspect of this is how it reveals that Mozilla, Microsoft and Google do zero due diligence before adding a new root CA. Relying on independent researchers to find problems.

[ Parent | on HN ]

Re:Web browsers drop mysterious company with ties to U.S. mi... by warp on Thursday December 01, 2022 @03:38PM (#33822369)

Is that still the case? Or is it just new root CAs get the appropriate amount of scrutiny, but a lot of existing CAs have been effectively grandfathered in because they were added two decades ago when folks weren't as diligent?

EDIT: elsewhere in the thread someone linked the bugzilla request for TrustCor to be added. I had assumed that was a long time ago, but it's "only" 7 years ago.

[ Parent | on HN ]