4 ms·

From the DigiNotar press release [1] on the matter: VASCO expects the impact of the breach of DigiNotar’s SSL and EVSSL business to be minimal. Through

From the DigiNotar press release [1] on the matter: VASCO expects the impact of the breach of DigiNotar’s SSL and EVSSL business to be minimal. Through the first six months of 2011, revenue from the SSL and EVSSL business was less than Euro 100,000. VASCO does not expect that the DigiNotar security incident will have a significant impact on the company’s future revenue or business plans. [1] - http://www.vasco.com/company/press_room/news_archive/2011/news_diginotar_reports_security_incident.aspx http://www.vasco.com/company/press_room/news_archive/2011/ne...

jen_h 15y ago
What in the world must DigiNotar's business plan for the future include? How could anyone trust them again? How is it possible that root-level certs were being issued and they've got no warning systems, no logging to determine what actually happened? And remember, we only really know about it now because someone caught the DigiNotar-issued SSL cert floating out in the wild and put it up on Pastebin! As rhizome noted, it borders criminality (if you think about it, does it even border?). These folks told users "Users of SSL certificates can depending on the browser vendor be confronted with a statement that the certificate is not trusted. This is in 99.9% of the cases incorrect, the certificate can be trusted" & their site is full of old defacement tags (on both of these, see http://isc.sans.org/diary/DigiNotar+breach+-+the+story+so+far/11500 http://isc.sans.org/diary/DigiNotar+breach+-+the+story+so+fa... - also worth reading). The CA system is broked. Everyone's known it for awhile, but man, it's still tough to look straight in the eyes at its brokenness like this.
pasbesoin 15y ago
I refrained from making this comment, before, but I guess I will now. We should, as well, be running the hell away from VASCO. At a minimum, their due diligence during the acquisition of DigiNotar was lacking. To the extent as the parent company they inherently have responsibility, they have also failed. I don't care if the acquisition is recent; in security, that's no excuse. Their citation of the monetary figure as reason to consider the matter "minimal" could be read as a further example of their contempt and/or disregard for the responsibility they shouldered with the DigiNotar acquisition. TL/DR: Stop saying "DigiNotar", and start saying (or also say) "VASCO".

jen_h 15y ago

What in the world must DigiNotar's business plan for the future include? How could anyone trust them again? How is it possible that root-level certs were being issued and they've got no warning systems, no logging to determine what actually happened? And remember, we only really know about it now because someone caught the DigiNotar-issued SSL cert floating out in the wild and put it up on Pastebin! As rhizome noted, it borders criminality (if you think about it, does it even border?). These folks told users "Users of SSL certificates can depending on the browser vendor be confronted with a statement that the certificate is not trusted. This is in 99.9% of the cases incorrect, the certificate can be trusted" & their site is full of old defacement tags (on both of these, see http://isc.sans.org/diary/DigiNotar+breach+-+the+story+so+far/11500 http://isc.sans.org/diary/DigiNotar+breach+-+the+story+so+fa... - also worth reading). The CA system is broked. Everyone's known it for awhile, but man, it's still tough to look straight in the eyes at its brokenness like this.

pasbesoin 15y ago

I refrained from making this comment, before, but I guess I will now. We should, as well, be running the hell away from VASCO. At a minimum, their due diligence during the acquisition of DigiNotar was lacking. To the extent as the parent company they inherently have responsibility, they have also failed. I don't care if the acquisition is recent; in security, that's no excuse. Their citation of the monetary figure as reason to consider the matter "minimal" could be read as a further example of their contempt and/or disregard for the responsibility they shouldered with the DigiNotar acquisition. TL/DR: Stop saying "DigiNotar", and start saying (or also say) "VASCO".