10 ms·
To get a better understanding of how DigiNotar operated, have a look at the Mozilla bug for their CA inclusion: https://bugzilla.mozilla.org/show_bug.cgi?id=369
by Maxious 15y ago
To get a better understanding of how DigiNotar operated, have a look at the Mozilla bug for their CA inclusion: https://bugzilla.mozilla.org/show_bug.cgi?id=369357 https://bugzilla.mozilla.org/show_bug.cgi?id=369357
- joshu 15y agoI read through this, but I didn't understand enough. It seemed like they were new to this - what did I miss?
- rdl 15y agoThat it is kind of absurd that the lives of Iranian dissidents depend on this relationship between browser developers and incompetent bid dumb organizations asserting trustworthiness and competence, IMO. Having lots of CAs is commercial pressure, but as log as any can issue for any, it means security is as vulnerable as the weakest company's weakest system or staffer.
- tptacek 15y agoThe lives of Iranian dissidents (a) really don't† and (b) shouldn't depend on browser CA configurations. In reality if your adversary is a hostile government, you should be taking steps beyond verifying SSL certificates. † but not for reasons that will make you happy
- rdl 15y agoTrue, the only reason this happened at all is that unlike most state actors, there are no Iranian CA in the browser roots to directly pressure.