3 ms·
Notwithstanding key pinning (which I believe is even overridden by installed private roots), they can issue for google.com as long as they want so long as they
by prdonahue 10y ago
Notwithstanding key pinning (which I believe is even overridden by installed private roots), they can issue for google.com as long as they want so long as they get their users to install a private root.
- Laforet 10y agoThis, MITM using voluntarily installed trust anchors is one thing and explicitly allowed by google, creating a certificate for google.com that will be accepts by all TLS clients is not and Symantec have got in trouble before for doing this.
- prdonahue 10y agoCompletely agree. But there's virtually no way Symantec would turn them loose without confidence in their audit and controls around issuance processes, domain control validation, etc. I say "virtually" as if they do, Google will drop the hammer on them (again), this time a much heavier one. It's a business risk I just don't see them taking — they have too big of a revenue base to jeopardize it this way.