3 ms·
Sooooo.. why keep it a secret until the patch? And why not disclose the targets? If the attacker already has the bogus certs then the damage is done.. or is it?
by extension 16y ago
Sooooo.. why keep it a secret until the patch? And why not disclose the targets? If the attacker already has the bogus certs then the damage is done.. or is it?
- JoachimSchipper 16y agoThe CA in question would likely prefer not to have their name all over this fiasco. Which is why the browsers blacklist something as opaque as serial numbers...
- extension 16y agoWhy are the browser makers indulging them on this?
- JoachimSchipper 16y agoBecause trust in the CA system is essential for the web as an application platform? Google wouldn't be happy if people started making native clients with hardcoded public keys because they didn't trust the CA system... (cf. cperciva's tarsnap.)
- extension 16y agoI can't see all the browser vendors being complicit in what would essentially be a cover-up just to make the internet look good. And anyway, they didn't cover it up, they just waited for the patch. But they checked it in to the public repos days ago, so they weren't trying to hide it from the attacker, just keep it low profile. That doesn't make sense for this type of vulnerability, unless there is something interesting we don't know about. My best guess is that we are waiting for audits of the target sites to finish, and I guess addons.mozilla.com is already done. EDIT: Nevermind, here is the list of affected sites: http://www.microsoft.com/technet/security/advisory/2524375.mspx http://www.microsoft.com/technet/security/advisory/2524375.m...
- JoachimSchipper 16y agoHey, I'm not the one talking about cover-ups. See my other comments in this thread.
- trotsky 16y agoA loss of trust in the CA system by the general public would likely lead to a loss of trust in the internet in general.
- gloob 16y agoSo the solution to "the CA system is not trustworthy" is "tell the public the CA system is trustworthy"? Edit: I mean, I can see how it's in the browser's interests to convince people that the system is reliable. And I can see how it's in web companies' interests to convince people that the system is reliable. But trying to convince people that the system is reliable when it is known not to be reliable strikes me as ethically questionable, at best.
- trotsky 16y agoI don't think we're disagreeing here, I was just trying to point out what the browser vendors motivations might be. It is also quite possible that law enforcement etc. requested a delay in the announcement to aid what has to be a significant ongoing investigation.
- JoachimSchipper 16y agoThe public wasn't lied to, or even spoken to - some browser makers just slapped a band-aid on a broken system to prevent it from visibly falling apart. People (but not necessarily Mozilla et al. - think cryptographers) should arguably be fixing the system instead, but it's a hard problem and immediate fixes would be needed anyway.