4 ms·
If the CA market were efficient this would lead to bankruptcy of this company since there's no reason to chose them over the many competitors and many reasons t
by guelo 10y ago
If the CA market were efficient this would lead to bankruptcy of this company since there's no reason to chose them over the many competitors and many reasons to distrust them. Though of course the market is not efficient. I keep wondering when the Communist Party of China is going to make its heavy handed presence felt in the CA world.
- gcp 10y agoThe browsers will distrust the CA. Which will, in all likelyhood, lead to their bankruptcy.
- voltagex_ 10y agoWill they? Still gotta wait for Google, Microsoft and Apple. Is there any mechanism to push certificate updates to Android devices in the wild? Otherwise there's going to be a lot of devices that trust WoSign and StartCom, no matter what.
- johncolanduoni 10y agoChrome doesn't have their own certificate store, instead they use the platform's certificate store with some logic layered on top (e.g. requiring new Symantec certificates to be in the certificate transparency logs). So an update to the Chrome app on Android could implement Mozilla's plan, or something even more extreme.
- vertex-four 10y agoIn practice, nobody is going to buy a cert for general web use which doesn't work for Firefox. They could scale back drastically and focus on internal certs and certs for other uses, but that might not be enough to keep them afloat, especially with the reputation damage from this.
- lolc 10y agoEven after this disclosures, a fully informed, rational agent would still choose WoSign if their price and service were the best. This is because WoSign's behavior does not specifically endanger their customers. The SSL ecosystem relies on the trustworthiness of the certificate authorities. If one of them is compromised, the whole system is compromised, not just their customers. This cannot be solved by markets. Instead, it's heavily regulated.
- michaelt 10y agoWoSign's behavior does not specifically endanger their customers. Or more precisely, problems such as issue N [1] endanger their customers, but endanger non-customers just as much. [1] https://wiki.mozilla.org/CA:WoSign_Issues#Issue_N:_Additional_Domain_Errors_.28June_2015.29 https://wiki.mozilla.org/CA:WoSign_Issues#Issue_N:_Additiona...