3 ms·
> Finally -- the CSR/key generation form page incorporates JavaScript from at least 5 or 6 different companies (including ad servers), which would allow any of
by lima 9y ago
> Finally -- the CSR/key generation form page incorporates JavaScript from at least 5 or 6 different companies (including ad servers), which would allow any of those third parties (intentionally or through compromise of their own) to capture generated keys. This is a reckless amount of exposure, to the point that even if the keys were generated completely inside the
browser and never exposed to the server (which does not appear to be the
case), I would consider them compromised at the time of generation.
Also, wow. That's extremely reckless.
- Bartweiss 9y agoJesus. That means it's not just about "offering revocation" and storing them on the wrong side; even people who didn't use that option are completely compromised.
- tialaramex 9y agoIf you generated your own Private Key and used that to make one or more CSRs, you can show any fool the CSR and no harm will come to you, at least on the cryptographic side. Upload it to 4chan, print it out on a T-shirt, doesn't matter. Any certificates produced are worthless to everybody except you, because you have the Private Key, and a _competent_ Certificate Authority (in this story that's Symantec or DigiCert, not Trustico) should only issue certificates for the names requested in the CSR, not any other names. A customer who did things sensibly (their own Private Key, make a CSR etcetera) and used Trustico say in 2016, needn't be concerned that these development will end with their certificates unilaterally revoked on Trustico's say-so. They might not want to do any more business with Trustico, but there's no particular reason this incident should affect their feelings about DigiCert or Comodo or any of the Symantec brands (Verisign / Thawte / RapidSSL / etcetera) now controlled by DigiCert.