News for hackers. Stuff that matters.

A comment on Lavabit abruptly shuts down. Parent comment

Re:Lavabit abruptly shuts down by __alexs on Thursday August 08, 2013 @04:51PM (#6181806)
It has implications for certificate pinning (like that used in Chrome) if you can only pin to CAs that operate in a single regulatory domain.
[ Parent | on HN ]
Re:Lavabit abruptly shuts down by sneak on Thursday August 08, 2013 @04:54PM (#6181834)
Indeed, I hadn't considered that.

Though, if you are pinning in an app and not just in-browser, you can bundle your internal CA cert in the binary and sidestep the whole mess.

This is what I advise my customers that have security-sensitive stuff do. The PKI can no longer be trusted.

[ Parent | on HN ]
Re:Lavabit abruptly shuts down by nwp90 on Thursday August 08, 2013 @05:14PM (#6181971)
"No longer"? It could never be trusted, and many of us said so when it was first introduced. It's just taken a while for everyone else to realise that we were right.
[ Parent | on HN ]