3 ms·

I remember that there was some talk about double voting (WoSign and StartCom not being separate entities, but voting with two votes) in the mailing list. Is the

by johnp_ 10y ago

I remember that there was some talk about double voting (WoSign and StartCom not being separate entities, but voting with two votes) in the mailing list. Is there a reason as to why this event hasn't been included in the document? edit: https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/0pqpLJ_lCJQ https://groups.google.com/forum/#!topic/mozilla.dev.security... > "In no case were these the deciding votes."

phonon 10y ago
It's in the wiki https://wiki.mozilla.org/CA:WoSign_Issues https://wiki.mozilla.org/CA:WoSign_Issues
- johnp_ 10y ago
  Could you please refer to the actual Issue? I can neither find anything related to the CA/B-Forum voting fraud nor to the yet unresolved Qihoo relationship.
  - phonon 10y ago
    Issue R? https://wiki.mozilla.org/CA:WoSign_Issues#Issue_R:_Purchase_of_StartCom_.28Nov_2015.29 https://wiki.mozilla.org/CA:WoSign_Issues#Issue_R:_Purchase_... Which links to https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/0pqpLJ_lCJQ https://groups.google.com/forum/#!topic/mozilla.dev.security...
pfg 10y ago
The issue you're describing is a concern for the CA/B Forum, not really all that relevant for Mozilla/mozilla.dev.security.policy. That being said, the CA/B Forum seems to be discussing the issue[1]. [1]: https://twitter.com/sleevi_/status/780454860676149248 https://twitter.com/sleevi_/status/780454860676149248
- johnp_ 10y ago
  Thank you, though the Qihoo relationship is not what I was referring to. I actually meant executing two votes in the CA/B Forum. As the connection between WoSign and StartCom was only incidentally found while investigating the other issues, I am questioning if there may be more dark sheep in the herd of CAs... we may just haven't looked hard enough. Do the Audit Requirements include checking for such relationships?
  - pfg 10y ago
    That's in all likelihood the same issue - Qihoo de facto owning two CAs who currently cast two separate votes in the CA/B Forum. Not sure if it would be a concern otherwise (i.e. if Qihoo were to own just one CA and not disclose that fact, I don't think that's relevant for the CA/B Forum, leaving aside the problem that they're also a member as a browser vendor ...) I think the voting rules are part of the bylaws (and not the Baseline Requirements), so I'm not certain if that's something that's looked into during the audits.

by johnp_ 10y ago

phonon 10y ago

It's in the wiki https://wiki.mozilla.org/CA:WoSign_Issues https://wiki.mozilla.org/CA:WoSign_Issues

johnp_ 10y ago
Could you please refer to the actual Issue? I can neither find anything related to the CA/B-Forum voting fraud nor to the yet unresolved Qihoo relationship.
- phonon 10y ago
  Issue R? https://wiki.mozilla.org/CA:WoSign_Issues#Issue_R:_Purchase_of_StartCom_.28Nov_2015.29 https://wiki.mozilla.org/CA:WoSign_Issues#Issue_R:_Purchase_... Which links to https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/0pqpLJ_lCJQ https://groups.google.com/forum/#!topic/mozilla.dev.security...

pfg 10y ago

The issue you're describing is a concern for the CA/B Forum, not really all that relevant for Mozilla/mozilla.dev.security.policy. That being said, the CA/B Forum seems to be discussing the issue[1]. [1]: https://twitter.com/sleevi_/status/780454860676149248 https://twitter.com/sleevi_/status/780454860676149248

johnp_ 10y ago
Thank you, though the Qihoo relationship is not what I was referring to. I actually meant executing two votes in the CA/B Forum. As the connection between WoSign and StartCom was only incidentally found while investigating the other issues, I am questioning if there may be more dark sheep in the herd of CAs... we may just haven't looked hard enough. Do the Audit Requirements include checking for such relationships?
- pfg 10y ago
  That's in all likelihood the same issue - Qihoo de facto owning two CAs who currently cast two separate votes in the CA/B Forum. Not sure if it would be a concern otherwise (i.e. if Qihoo were to own just one CA and not disclose that fact, I don't think that's relevant for the CA/B Forum, leaving aside the problem that they're also a member as a browser vendor ...) I think the voting rules are part of the bylaws (and not the Baseline Requirements), so I'm not certain if that's something that's looked into during the audits.