4 ms·
This is not a security flaw in Axis, this is a leaked trusted key that could be used to sign any extension (or possibly any other type of signed code). Any code
by kevinpet 14y ago
This is not a security flaw in Axis, this is a leaked trusted key that could be used to sign any extension (or possibly any other type of signed code). Any code purporting to come from Yahoo is unsafe, probably until Chrome is updated.
- ajross 14y agoSurely Chrome implements a cert revocation mechanism; the idea of using a cert to establish identity really doesn't work without it (for precisely this reason). Anyone have details?
- adgar 14y agoIt does. See drgath's comment: http://news.ycombinator.com/item?id=4019500 http://news.ycombinator.com/item?id=4019500
- kevinpet 14y agoI wasn't sure it if it was reliable. I remember during the last "ca leaks root cert" fiasco there was talk about how browsers don't implement this securely.
- ajross 14y agoRight, but that's different. That was a root certificate that was compromised: something you can use to make new certs. The basic certs themselves can be revoked, and are fairly routinely. There is always a root of trust in a cert scheme (vs. a web scheme, say, which has no single point of failure but a squishier notion of validity). The reason it got caught is that Chrome implemented an independent "pinning" feature for Google's own domains (basically an independent root of trust) and caught the fraudulent certs.