6 ms·

Wikipedia has a nice list of previous Comodo malfeasance: https://en.wikipedia.org/wiki/Comodo_Group#Controversies https://en.wikipedia.org/wiki/Comodo_Group#Co

Wikipedia has a nice list of previous Comodo malfeasance: https://en.wikipedia.org/wiki/Comodo_Group#Controversies https://en.wikipedia.org/wiki/Comodo_Group#Controversies Highlights include allowing fraudulent certs to be issued for Google, Yahoo, and Mozilla; working with a malware company; and trademark shenanigans with Let's Encrypt.

chipperyman573 9y ago
>working with a malware company Why is this a bad thing? A cert says "Yes, person x REALLY IS person x, and I can prove it mathematically." It doesn't say "Person x is trustworthy enough for me to vouch for them."
- NelsonMinar 9y ago
  Who do you imagine they verified was Person X? More on the malware cert issuance: https://blogs.msmvps.com/donna/2009/05/18/microsoft-mvp-mike-burgess-respond-to-comodo-s-ceo-on-comodo-certificates-issued-to-malware-distributors/ https://blogs.msmvps.com/donna/2009/05/18/microsoft-mvp-mike... For malware concerns there's also Comodo's relationship with PrivDog. I'm not clear on whether PrivDog is deliberate malware or just incompetent insecure software.
  - cortesoft 9y ago
    That is ridiculous, to expect a CA to google every cert request domain and check what they are doing? That is a ridiculous requirement - cert issuance is automatic. Do you think we should stop allowing Let's Encrypt to issue certs? You know they don't google each domain to see what they are doing.
    - pitaj 9y ago
      In my opinion, it would be worse if they denied certs to certain people.
  - geofft 9y ago
    > Who do you imagine they verified was Person X? The legitimate owner of that domain or operator of the website. That's what certificates are supposed to attest to. Malware authors might be bad people, but they're definitely people who exist in real life and have an identity that can be attested to.
zimbatm 9y ago
In this particular case it's more likely negligence. I can easily see how a missing integration test, and a few code changes later, the feature gets broken and nobody notices it. It doesn't prevent any normal codepath from executing properly.
0xfeba 9y ago
The best one is their stupid Chromodo "Secure" Browser, that used --disable-web-security: https://threatpost.com/chromodo-browser-disables-same-origin-policy/116131/ https://threatpost.com/chromodo-browser-disables-same-origin...

chipperyman573 9y ago

>working with a malware company Why is this a bad thing? A cert says "Yes, person x REALLY IS person x, and I can prove it mathematically." It doesn't say "Person x is trustworthy enough for me to vouch for them."

NelsonMinar 9y ago
Who do you imagine they verified was Person X? More on the malware cert issuance: https://blogs.msmvps.com/donna/2009/05/18/microsoft-mvp-mike-burgess-respond-to-comodo-s-ceo-on-comodo-certificates-issued-to-malware-distributors/ https://blogs.msmvps.com/donna/2009/05/18/microsoft-mvp-mike... For malware concerns there's also Comodo's relationship with PrivDog. I'm not clear on whether PrivDog is deliberate malware or just incompetent insecure software.
- cortesoft 9y ago
  That is ridiculous, to expect a CA to google every cert request domain and check what they are doing? That is a ridiculous requirement - cert issuance is automatic. Do you think we should stop allowing Let's Encrypt to issue certs? You know they don't google each domain to see what they are doing.
  - pitaj 9y ago
    In my opinion, it would be worse if they denied certs to certain people.
- geofft 9y ago
  > Who do you imagine they verified was Person X? The legitimate owner of that domain or operator of the website. That's what certificates are supposed to attest to. Malware authors might be bad people, but they're definitely people who exist in real life and have an identity that can be attested to.

zimbatm 9y ago

In this particular case it's more likely negligence. I can easily see how a missing integration test, and a few code changes later, the feature gets broken and nobody notices it. It doesn't prevent any normal codepath from executing properly.

0xfeba 9y ago

The best one is their stupid Chromodo "Secure" Browser, that used --disable-web-security: https://threatpost.com/chromodo-browser-disables-same-origin-policy/116131/ https://threatpost.com/chromodo-browser-disables-same-origin...