News for hackers. Stuff that matters.

A comment on Linux Certificate Authority root stores have a too simple view of 'trust'. Parent comment

Re:Linux Certificate Authority root stores have a too simple... by NovemberWhiskey on Tuesday December 06, 2022 @08:03AM (#33878994)
>So yes shipping a CA known to have intentionally issued false certificates is very on-brand for them.

Did TrustCor turn out to have done that? The last time I checked in on that, the distrust was mainly founded on some not-very-trustworthy behavior involving spyware in a related company within the same corporate umbrella.

[ Parent | on HN ]
Re:Linux Certificate Authority root stores have a too simple... by Fatnino on Tuesday December 06, 2022 @09:57AM (#33880961)
To be removed, a CA just needs to show it is not worthy of trust.

TrustCor met this requirement and got removed.

Other CAs removed in the past also showed they are unworthy of trust, but in even more blatant ways.

[ Parent | on HN ]
Re:Linux Certificate Authority root stores have a too simple... by NovemberWhiskey on Tuesday December 06, 2022 @10:04AM (#33881094)
Yes - I know - I'm responding to the accusation in the quote, which is not at all substantiated.
[ Parent | on HN ]
Re:Linux Certificate Authority root stores have a too simple... by Fatnino on Tuesday December 06, 2022 @01:15PM (#33884592)
You misunderstood the accusation as being leveled against TrustCor when in fact the commenter was referring to Symantec
[ Parent | on HN ]
Re:Linux Certificate Authority root stores have a too simple... by hamburglar on Tuesday December 06, 2022 @10:45AM (#33881904)
You’re 100% right. They were unable to convince the right folks that they were trustworthy, and they appear to be in a prime position to abuse misplaced trust due to some fundamental conflicts of interest, but “known to have intentionally issued false certificates” is a false accusation.
[ Parent | on HN ]
Re:Linux Certificate Authority root stores have a too simple... by cmeacham98 on Tuesday December 06, 2022 @01:24PM (#33884708)
I was referring to Ubuntu shipping Symantec.
[ Parent | on HN ]
Re:Linux Certificate Authority root stores have a too simple... by raxxorraxor on Wednesday December 07, 2022 @04:51AM (#33892509)
The removal of Symantec was a bit questionable as well. There is reason for strictness here, but I don't think having used their certs a bit longer was a relevant security threat at all.

Trustcor allegedly spread spyware, which I do think makes anyone untrustworthy. But it should be checked if allegations can be confirmed.

[ Parent | on HN ]