6 ms·
That's a bit more information, but the headline here at HN is still overblown; we're down to one unidentified root certificate that was probably issued by RSA,
by olefoo 17y ago
That's a bit more information, but the headline here at HN is still overblown; we're down to one unidentified root certificate that was probably issued by RSA, but for which no records can be found. Most probably attributable to incompetence and poor recordkeeping rather than a malicious compromise of the whole PKI.
- extension 17y agoIf I was going to sneak in my own root cert, I would give it a name and date very similar to an existing one.
- bigiain 17y agoAnd wasn't there some discussion in the last week or two about how easily you could impersonate anybodies valid ssl cert if you could get hold of a real root cert? (something about browsers not notifying users that a previously seen cert is now authenticating via a different root?)
- extension 17y agoI am not a crypto expert so correct me if I'm wrong, but as I understand it, anyone with a root key necessarily can subvert the entire system in a straightforward way.