4 ms·

Hopefully the bigger CAs have better policies, and would inform vendors immediately. (I'm sure Diginotar had policies too, just that they probably weren't follo

by Skalman 15y ago

Hopefully the bigger CAs have better policies, and would inform vendors immediately. (I'm sure Diginotar had policies too, just that they probably weren't followed) But if a CA was compromised and they didn't know the how many certificates they had issued, surely they'd have to block the root cert, if not permanently?

dmethvin 15y ago
If you shut down one of the big boys like VeriSign you might as well shut down the Internet as far as someone like Amazon is concerned, since VeriSign issued their SSL. The entire ecommerce world would be at Challenger-level rationalization, in essence, "How do you know it will burn through the O-rings? Since we don't have enough evidence we can't shut it down!" I think it's much more likely that lacking any evidence of widespread active fraud, ecommerce would simply go on as usual but with more trip wires to detect fraud and perhaps delayed payments to reduce the chance that money from fraudulent transactions would make its way to the bad guys. And of course, they'd switch out all the certs ASAP. It's a chance merchants and banks would be willing to take, I suspect, and sort out damages in court afterwards.
- Skalman 15y ago
  True. We really need a plan B, to plan what to do in such a scenario, but there doesn't seem to be enough of an incentive to improve the system yet.
  - marshray 15y ago
    Amazon gets a new cert with a different provider and revokes the old one. Those people are pretty talented operationally. This should not be a difficult thing to do.
    - mseebach 15y ago
      Given the catastrophic nature of being without a cert and the relative low cost of those, it's not hard to believe that they maintain a backup certificate, ready to switch in at a moments notice.
      - marshray 15y ago
        Probably lots of sites will after this week. IMHO it's getting a little out of hand how much concern is being given to the gov.nl private PKI system and the few hundred other certs Diginotar issued where the website admins have to swap a file or two. The big deal is the security of the whole freaking internet resting on top of this tiny little web app and server in .nl and the unknown number of actual users in .ir getting MitMd and likely horribly persecuted.
- nknight 15y ago
  One thing to remember is that VeriSign was originally an RSA spinoff, and helped define the role and requirements of today's certificate authorities. Granted a lot has happened since then, including the CA unit's sale to Symantec, but I'd be very, very surprised if VeriSign/Symantec handled a breach in the totally incompetent manner DigiNotar has. Long-term, it's becoming less of an issue anyway. The market is always spreading out, and the market share of the "big boys" will continue to shrink. More CAs means more possible breaches, of course, but it also reduces the wider cost of shutting down any single CA. (Not that I don't agree that the CA system as currently constituted has issues, I just don't think VeriSign is the big problem.)

by Skalman 15y ago

dmethvin 15y ago

If you shut down one of the big boys like VeriSign you might as well shut down the Internet as far as someone like Amazon is concerned, since VeriSign issued their SSL. The entire ecommerce world would be at Challenger-level rationalization, in essence, "How do you know it will burn through the O-rings? Since we don't have enough evidence we can't shut it down!" I think it's much more likely that lacking any evidence of widespread active fraud, ecommerce would simply go on as usual but with more trip wires to detect fraud and perhaps delayed payments to reduce the chance that money from fraudulent transactions would make its way to the bad guys. And of course, they'd switch out all the certs ASAP. It's a chance merchants and banks would be willing to take, I suspect, and sort out damages in court afterwards.

Skalman 15y ago
True. We really need a plan B, to plan what to do in such a scenario, but there doesn't seem to be enough of an incentive to improve the system yet.
- marshray 15y ago
  Amazon gets a new cert with a different provider and revokes the old one. Those people are pretty talented operationally. This should not be a difficult thing to do.
  - mseebach 15y ago
    Given the catastrophic nature of being without a cert and the relative low cost of those, it's not hard to believe that they maintain a backup certificate, ready to switch in at a moments notice.
    - marshray 15y ago
      Probably lots of sites will after this week. IMHO it's getting a little out of hand how much concern is being given to the gov.nl private PKI system and the few hundred other certs Diginotar issued where the website admins have to swap a file or two. The big deal is the security of the whole freaking internet resting on top of this tiny little web app and server in .nl and the unknown number of actual users in .ir getting MitMd and likely horribly persecuted.
nknight 15y ago
One thing to remember is that VeriSign was originally an RSA spinoff, and helped define the role and requirements of today's certificate authorities. Granted a lot has happened since then, including the CA unit's sale to Symantec, but I'd be very, very surprised if VeriSign/Symantec handled a breach in the totally incompetent manner DigiNotar has. Long-term, it's becoming less of an issue anyway. The market is always spreading out, and the market share of the "big boys" will continue to shrink. More CAs means more possible breaches, of course, but it also reduces the wider cost of shutting down any single CA. (Not that I don't agree that the CA system as currently constituted has issues, I just don't think VeriSign is the big problem.)