3 ms·
It's heartening but it's also not. Surely there have been many other cases of invalid certs being granted for lower profile sites, perhaps by this very same CA,
by stanleydrew 15y ago
It's heartening but it's also not. Surely there have been many other cases of invalid certs being granted for lower profile sites, perhaps by this very same CA, without any of us ever hearing about it. And surely the granter of one of those is still considered valid within many browser/OS configurations. But because this was an invalid Google cert the CA gets shut down.
It kind of highlights the difficult problem of when to decide to blacklist a CA in the current model.
And for clarity, who/what do you think is the real power behind Internet trust? I've been thinking about it for five minutes and can't come up with a good answer.
- thurn 15y agoBrowser vendors, perhaps?
- wisty 15y agoAnd OS vendors. And whoever configures the computer. You buy a computer that was made in China, and it has root certs already in there (thanks to either Microsoft or Apple, or the shop who sold it, or the guys who assembled it - who knows?). Chome / Safari uses the system certs. All good, right?
- deleted 15y ago[deleted]
- patio11 15y agoThe real power is browser vendors. If you simultaneously piss off Apple, Microsoft, Google, Mozilla, etc enough such that breaking thousands of sites on the Internet is preferable to continuing to ship your certificate, by implication you are not trustworthy. It's an oligopoly model, but I think "allowing Iran to read customers' email makes you persona non grata" is exactly the result I would want, regardless of how that result is reached structurally.
- rhizome 15y agowho/what do you think is the real power behind Internet trust Nobody, it's all fiat. Verisign started this scam and we're just seeing the follow-on effects. There has never been anything more than the words and policies supporting the CA industry.