3 ms·
>working with a malware company Why is this a bad thing? A cert says "Yes, person x REALLY IS person x, and I can prove it mathematically." It doesn't say "Per
by chipperyman573 9y ago
>working with a malware company
Why is this a bad thing? A cert says "Yes, person x REALLY IS person x, and I can prove it mathematically." It doesn't say "Person x is trustworthy enough for me to vouch for them."
- NelsonMinar 9y agoWho do you imagine they verified was Person X? More on the malware cert issuance: https://blogs.msmvps.com/donna/2009/05/18/microsoft-mvp-mike-burgess-respond-to-comodo-s-ceo-on-comodo-certificates-issued-to-malware-distributors/ https://blogs.msmvps.com/donna/2009/05/18/microsoft-mvp-mike... For malware concerns there's also Comodo's relationship with PrivDog. I'm not clear on whether PrivDog is deliberate malware or just incompetent insecure software.
- cortesoft 9y agoThat is ridiculous, to expect a CA to google every cert request domain and check what they are doing? That is a ridiculous requirement - cert issuance is automatic. Do you think we should stop allowing Let's Encrypt to issue certs? You know they don't google each domain to see what they are doing.
- pitaj 9y agoIn my opinion, it would be worse if they denied certs to certain people.
- geofft 9y ago> Who do you imagine they verified was Person X? The legitimate owner of that domain or operator of the website. That's what certificates are supposed to attest to. Malware authors might be bad people, but they're definitely people who exist in real life and have an identity that can be attested to.