3 ms·

>So yes shipping a CA known to have intentionally issued false certificates is very on-brand for them. Did TrustCor turn out to have done that? The last time I

>So yes shipping a CA known to have intentionally issued false certificates is very on-brand for them. Did TrustCor turn out to have done that? The last time I checked in on that, the distrust was mainly founded on some not-very-trustworthy behavior involving spyware in a related company within the same corporate umbrella. EDIT: Link to the rationale for distrust from Mozilla ... https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ https://groups.google.com/a/mozilla.org/g/dev-security-polic... excerpt: "There is no evidence of TrustCor mis-issuing TLS or SMIME certificates."

Fatnino 4y ago
To be removed, a CA just needs to show it is not worthy of trust. TrustCor met this requirement and got removed. Other CAs removed in the past also showed they are unworthy of trust, but in even more blatant ways.
- NovemberWhiskey 4y ago
  Yes - I know - I'm responding to the accusation in the quote, which is not at all substantiated.
  - Fatnino 4y ago
    You misunderstood the accusation as being leveled against TrustCor when in fact the commenter was referring to Symantec
hamburglar 4y ago
You’re 100% right. They were unable to convince the right folks that they were trustworthy, and they appear to be in a prime position to abuse misplaced trust due to some fundamental conflicts of interest, but “known to have intentionally issued false certificates” is a false accusation.
cmeacham98 4y ago
I was referring to Ubuntu shipping Symantec.
raxxorraxor 4y ago
The removal of Symantec was a bit questionable as well. There is reason for strictness here, but I don't think having used their certs a bit longer was a relevant security threat at all. Trustcor allegedly spread spyware, which I do think makes anyone untrustworthy. But it should be checked if allegations can be confirmed.

Fatnino 4y ago

To be removed, a CA just needs to show it is not worthy of trust. TrustCor met this requirement and got removed. Other CAs removed in the past also showed they are unworthy of trust, but in even more blatant ways.

NovemberWhiskey 4y ago
Yes - I know - I'm responding to the accusation in the quote, which is not at all substantiated.
- Fatnino 4y ago
  You misunderstood the accusation as being leveled against TrustCor when in fact the commenter was referring to Symantec

hamburglar 4y ago

You’re 100% right. They were unable to convince the right folks that they were trustworthy, and they appear to be in a prime position to abuse misplaced trust due to some fundamental conflicts of interest, but “known to have intentionally issued false certificates” is a false accusation.

cmeacham98 4y ago

I was referring to Ubuntu shipping Symantec.

raxxorraxor 4y ago

The removal of Symantec was a bit questionable as well. There is reason for strictness here, but I don't think having used their certs a bit longer was a relevant security threat at all. Trustcor allegedly spread spyware, which I do think makes anyone untrustworthy. But it should be checked if allegations can be confirmed.