3 ms·

No, its not. This problem detected by a third-party due to a recent industry initiative (Certificate Transparency). Now Google has doled out appropriate punitiv

by vtlynch 11y ago

No, its not. This problem detected by a third-party due to a recent industry initiative (Certificate Transparency). Now Google has doled out appropriate punitive measures which will greatly reduce chances of this happening again. The industry is moving forward and doing lots to improve. Lets also not forget a hugely important point that there is no evidence of harm from Symantec's action. They were just embarrassingly stupid and irresponsible.

gefh 11y ago
But this is the 4th or 5th similar announcement I recall, some of which have been malicious, some incompetent. Maybe CAs are getting better but 'trusted' is not the first word that comes to mind any more.
- vtlynch 11y ago
  Is the system problematic? Yes. Does it have room for improvement? Tons. Is it broken? No, I dont think so. I dont think the CA system is unique in having breaches, holes, or incompetent actors.
  - glass- 11y ago
    The CA system is unique is that one hole, breach or incompetent actor compromises the entire system. It's also unique is that when an authority has a hole, breach or is an incompetent actor, it's very difficult to remove them from authority.
    - vtlynch 11y ago
      >It's also unique is that when an authority has a hole, breach or is an incompetent actor, it's very difficult to remove them from authority. There is no proof of this. There are lots of systems in place to deal with mistakes and trust breaches. If it gets to the extent that a Root or CA needs to be removed from trust stores, then they are removed. Just this year we saw two CAs lose their trust.
- geofft 11y ago
  This is the first of those by a CA that is actually too big to fail. I think the last too-big-to-fail CA that misissued certs in recent memory was Comodo, in March 2011, who had a reseller's account broken into (apparently by an Iranian state-sponsored attacker). And that was well before there were options like insisting on Certificate Transparency, and Comodo reacted well (they had an accurate audit trail and deployed changes that blocked the attacker when they retried two weeks later), and it didn't involve active incompetence on Comodo's part. Since then, there's also been CNNIC, India CCA, TURKTRUST, ANSSI, and DigiNotar. CNNIC and DigiNotar have both been removed from Chrome's root store, India CCA and ANSSI have been restricted to their country's TLDs, and TURKTRUST (which apparently reacted well) lost their EV powers. (There were also a couple of misissued certs due to Microsoft Live allowing anyone to sign up for accounts like "hostmaster", but those are not considered the CA's fault.)

by vtlynch 11y ago

gefh 11y ago

But this is the 4th or 5th similar announcement I recall, some of which have been malicious, some incompetent. Maybe CAs are getting better but 'trusted' is not the first word that comes to mind any more.

vtlynch 11y ago
Is the system problematic? Yes. Does it have room for improvement? Tons. Is it broken? No, I dont think so. I dont think the CA system is unique in having breaches, holes, or incompetent actors.
- glass- 11y ago
  The CA system is unique is that one hole, breach or incompetent actor compromises the entire system. It's also unique is that when an authority has a hole, breach or is an incompetent actor, it's very difficult to remove them from authority.
  - vtlynch 11y ago
    >It's also unique is that when an authority has a hole, breach or is an incompetent actor, it's very difficult to remove them from authority. There is no proof of this. There are lots of systems in place to deal with mistakes and trust breaches. If it gets to the extent that a Root or CA needs to be removed from trust stores, then they are removed. Just this year we saw two CAs lose their trust.
geofft 11y ago
This is the first of those by a CA that is actually too big to fail. I think the last too-big-to-fail CA that misissued certs in recent memory was Comodo, in March 2011, who had a reseller's account broken into (apparently by an Iranian state-sponsored attacker). And that was well before there were options like insisting on Certificate Transparency, and Comodo reacted well (they had an accurate audit trail and deployed changes that blocked the attacker when they retried two weeks later), and it didn't involve active incompetence on Comodo's part. Since then, there's also been CNNIC, India CCA, TURKTRUST, ANSSI, and DigiNotar. CNNIC and DigiNotar have both been removed from Chrome's root store, India CCA and ANSSI have been restricted to their country's TLDs, and TURKTRUST (which apparently reacted well) lost their EV powers. (There were also a couple of misissued certs due to Microsoft Live allowing anyone to sign up for accounts like "hostmaster", but those are not considered the CA's fault.)