3 ms·

Since there was substantial evidence that these were one and the same company. The CA had no substantial public certificate issuing program regardless so kickin

Since there was substantial evidence that these were one and the same company. The CA had no substantial public certificate issuing program regardless so kicking it out was an easy decision either way (and begs the question what exactly it is they were doing to justify the multi million dollar operating costs of a root CA).

charcircuit 4y ago
>there was substantial evidence circumstantial evidence, but nothing that was definitive >The CA had no substantial public certificate issuing program So just because they don't have enough customers they should be removed? This just promotes centralization of trust.
- DoctorNick 4y ago
  It really doesn’t matter if it was circumstantial or not. When presented with such evidence, the TrustCor rep was extremely evasive. This isn’t a court of law; if a Root CA can’t be up-front about explaining evidence that calls their trust into question, then they cannot be trusted and deserve to have their certificates yanked.
  - dcow 4y ago
    They were under attack. I actually read the whole thread and they were crystal clear.
    - ranguna 4y ago
      Yeah I personally feel for the rep, they were indeed under attack. But there is no going around it, a company that advertised a product as being e2e encrypted when it really was not, having multiple levels of ties with the CA was enough to deem the CA as unfit. I agree with this conclusion because the CA ecosystem is a fragile one if not governed strictly, since the risks are of the highest concern to the general use of the Internet.
- netheril96 4y ago
  > circumstantial evidence, but nothing that was definitive CAs should be assumed guilty until proven otherwise.
- simplotek 4y ago
  > circumstantial evidence, but nothing that was definitive That's not how things work. The role of a Certificate Authority is to act as a trusted third party. If that third party is unable or unwilling to demonstrate that they are trustworthy then naturally they can't be expected to assume that role.

charcircuit 4y ago

>there was substantial evidence circumstantial evidence, but nothing that was definitive >The CA had no substantial public certificate issuing program So just because they don't have enough customers they should be removed? This just promotes centralization of trust.

DoctorNick 4y ago
It really doesn’t matter if it was circumstantial or not. When presented with such evidence, the TrustCor rep was extremely evasive. This isn’t a court of law; if a Root CA can’t be up-front about explaining evidence that calls their trust into question, then they cannot be trusted and deserve to have their certificates yanked.
- dcow 4y ago
  They were under attack. I actually read the whole thread and they were crystal clear.
  - ranguna 4y ago
    Yeah I personally feel for the rep, they were indeed under attack. But there is no going around it, a company that advertised a product as being e2e encrypted when it really was not, having multiple levels of ties with the CA was enough to deem the CA as unfit. I agree with this conclusion because the CA ecosystem is a fragile one if not governed strictly, since the risks are of the highest concern to the general use of the Internet.
netheril96 4y ago
> circumstantial evidence, but nothing that was definitive CAs should be assumed guilty until proven otherwise.
simplotek 4y ago
> circumstantial evidence, but nothing that was definitive That's not how things work. The role of a Certificate Authority is to act as a trusted third party. If that third party is unable or unwilling to demonstrate that they are trustworthy then naturally they can't be expected to assume that role.