4 ms·
It's more likely than not that there's a harmless explanation for this one, but with the rash of these stories lately I think it's past time to declare that the
by dfranke 17y ago
It's more likely than not that there's a harmless explanation for this one, but with the rash of these stories lately I think it's past time to declare that the PKI trust model is broken.
- Torn 17y agoCan anyone find the link to that recent article / guide on registering a likely-looking address at a webmail provider then scamming a root certificate for that domain? The article gave the impression that some CA's are a bit too happy to issue root certs, and he mentioned he's been blogging about the whole SSL trust system being broken for quite a few years now.
- SomeCallMeTim 17y agoWhat troubles me is that no one has tried actually looking for sites that use this cert. If any valid sites are signed using this cert, then it's a simple matter of asking them who they paid for certification. It's of course harder to prove that NO sites use this cert. If there's a way to craft a Google query that searches for sites signed by a particular cert, that could go some distance to indicating whether it's been used and where.