4 ms·
I am interested in (a). Recently I heard from a trusted source who works for a popular CDN that some top levels CAs, who are trusted in my browser, are known to
by zbuf 11y ago
I am interested in (a). Recently I heard from a trusted source who works for a popular CDN that some top levels CAs, who are trusted in my browser, are known to be issuing certificates for domains which they have no authority to be doing so, for the purpose of man-in-the-middle analysis by certain parties. But that there is a reluctance to pull these certificates because that would be like switching off portions of the web.
Is there any truth or more solid reference to this from those who are in the industry and know more about these topics? Rather alarming if so.
- feld 11y agoYes, there's truth in it. It's takes time for them to be caught and punished, and the Certificate Transparency effort will make it much more difficult for these scumbags to do so.
- glasz 11y agojust listen to security now [0]. it'll make your blood boil how, e.g., symantec fucks up over and over again. this industry is full of incompetent idiots. [0] https://twit.tv/shows/security-now https://twit.tv/shows/security-now (episode 532 is particularly revealing)
- zbuf 11y agoThanks, interesting to hear. If I heard correctly this is a case of incompetence -- which is certainly a problem. Though the information I heard was about lesser-known CAs granting certificates to enable some kind of snooping. It seems that a problem with the current implementation of SSL is that it conflates the requirement for encryption with that for identification. Knowing that "Symantec thinks this is google.com" has limited benefit to me; I'm happier with the idea that "This is the same google.com you visited before".