5 ms·
There are 3 major CAs: VeriSign (47% share), GoDaddy (23%), Comodo (15%). So would they remove VeriSign or GoDaddy? I really doubt that, those CAs hold way too
by jmtame 15y ago
There are 3 major CAs: VeriSign (47% share), GoDaddy (23%), Comodo (15%). So would they remove VeriSign or GoDaddy? I really doubt that, those CAs hold way too much of the market. I guess the question is: would those big CAs make the same mistake?
Relevant quote: "This is a nightmare scenario. You have to trust the companies selling these certificates and if we can't, then all bets are off." —Mikko Hyppönen, head of research at F-Secure
- burgerbrain 15y agoNot only will they make mistakes, they already have.
- haberman 15y agoCitation needed.
- burgerbrain 15y agoComodo had huge issues very recently, and VeriSign's issues go back about as far as they do (providing intercept services to governments. That wasn't even an 'accident'.) Godaddy? I don't know much about what they do but I wager you wouldn't have to dig deep. Edit: I'm not the only one saying this: http://www.youtube.com/watch?v=Z7Wl2FW2TcA http://www.youtube.com/watch?v=Z7Wl2FW2TcA Modding me down will not restore the trust.
- haberman 15y agoYou're getting modded down because you are not providing any specifics. "Comodo had huge issues" is not a citation; it doesn't contain enough information for people to independently evaluate your claims. Another commenter provided an actual link (and did not get modded down).
- burgerbrain 15y agoThis is common knowledge, unless you've been under a rock. It's not my job to google things for other people. http://www.google.com/search?q=comodo+incident http://www.google.com/search?q=comodo+incident http://www.hnsearch.com/search#request/submissions&q=comodo&start=0 http://www.hnsearch.com/search#request/submissions&q=com...
- vladd 15y agoIf you speak on HN and have an expectation to avoid down-voting, it is your job to back up your claims. It's not practical to Google claims for every comment.
- SamReidHughes 15y agoIf you speak on HN and have an expectation to avoid down-voting, it is your job to back up your claims. It's not practical to Google claims for every comment. I'd like to see a citation for that.
- rhizome 15y agoIt's a social convention to support your arguments when debating.
- deleted 15y ago[deleted]
- haberman 15y agoNo, your job is to be specific enough about what you are claiming that people can independently evaluate your claims. You could have said "Comodo suffered a compromise in March that led to 9 fraudulently-issued certs." To say they "had huge issues very recently" could mean lots of different things, and it's not specific enough to Google for (even after searching there's no way to know whether the search results are what you were talking about or not).
- Skalman 15y agoI think only Comodo has had a (known) breach (http://en.wikipedia.org/wiki/Comodo_Group#Iran_SSL_certificate_controversy http://en.wikipedia.org/wiki/Comodo_Group#Iran_SSL_certifica...), but it's not at all the same as with Diginotar - they informed vendors quickly, and had a list of false certificates available.
- lawnchair_larry 15y agoSymantec, who owns Verisign, has also been breached pretty badly in the past (Aurora), which they failed to disclose. No known issues with their certs, but still.