2 ms·

Thanks "there"! It's good to know. The trouble is neither the sans.org notice nor the StartSSL site give any real detail on how bad this latest SSL fiasco reall

by jcr 15y ago

Thanks "there"! It's good to know. The trouble is neither the sans.org notice nor the StartSSL site give any real detail on how bad this latest SSL fiasco really is. For example: > Subscribers and holders of valid certificates are not affected in any form. Visitors to web sites and other parties relying on valid certificates are not affected. In other words, if there are bogus certs out there, they will still work. (sigh)

extension 15y ago
I think that means there are no bogus certs. The Register is a bit more clear about it: The hackers behind the attack on StartCom failed to obtain any certificates that would allow them to spoof websites in a similar fashion, and they were also unsuccessful in generating an intermediate certificate that would allow them to act as their own certificate authority, Nigg said in an email
- pasbesoin 15y ago
  Yes, the linked document is really just notes the existence of the situation. It links the Register article that has more detail: http://www.theregister.co.uk/2011/06/21/startssl_security_breach/ http://www.theregister.co.uk/2011/06/21/startssl_security_br...