News for hackers. Stuff that matters.

A comment on Launching in 2015: A Certificate Authority to Encrypt the Entire Web. Parent comment

Re:Launching in 2015: A Certificate Authority to Encrypt the... by duaneb on Tuesday November 18, 2014 @11:44AM (#8624743)
> FWIW, (valid) rogue certificates have been found in the wild several times, CAs have been compromised etc. ...

And it's only going to get worse as SHA-1 become more and more affordable to crack.

[ Parent | on HN ]
Re:Launching in 2015: A Certificate Authority to Encrypt the... by pde3 on Tuesday November 18, 2014 @02:06PM (#8625649)
The CAs have agreed to stop using SHA-1 by 2016, and Let's Encrypt will launch with something stronger on day one.

But SHA-1 attacks are going to be a huge problem all over our protocol stack :(

[ Parent | on HN ]