3 ms·
Seems to me that Digicert is tactically forgetting to say what they said to Trustico. Additionally there's not an issue with Trustico having access to the priv
by emilfihlman 9y ago
Seems to me that Digicert is tactically forgetting to say what they said to Trustico.
Additionally there's not an issue with Trustico having access to the private keys. It simply means you are trusting Trustico and if you accept that it's no different from trusting Google or Facebook or your bank with your private data.
- bllguo 9y agoSo what's your response to this? > Finally -- the CSR/key generation form page incorporates JavaScript from at least 5 or 6 different companies (including ad servers), which would allow any of those third parties (intentionally or through compromise of their own) to capture generated keys. This is a reckless amount of exposure, to the point that even if the keys were generated completely inside the browser and never exposed to the server (which does not appear to be the case), I would consider them compromised at the time of generation.