5 ms·
I found it interesting that GoDaddy revoked the certificate - previously, I had assumed Levison did it himself.
by crb 13y ago
I found it interesting that GoDaddy revoked the certificate - previously, I had assumed Levison did it himself.
- annnnd 13y agoGood point - linked article missed that (crucial IMHO) piece of data.
- Shivetya 13y agoI am curious if the FBI could step in and prevent GoDaddy from taking this action. Secret courts do not seem to have realistic limits. In this context, can SSL be trusted?
- deleted 13y ago[deleted]
- p4bl0 13y agoWell, now that the certificate has been revoked, it's too late for the FBI to do anything: either users saw that the certificate has been revoked, or they didn't yet but if a new certificate is installed they will see that it's a new one with a different fingerprint (at least their browser should warn them of that).
- msumpter 13y agoI don't think it's entirely clear that GoDaddy revoked the certificate on their own. Their statement was they were made aware, it's unclear if they became aware based on news coverage, or Levison made them aware of the key compromise. I'm not entirely convinced GoDaddy would want to insert itself voluntarily into a federal court case based on news reports. But I do think they would revoke a certificate if Levison reported the key compromised as standard procedure. I can see threats of obstruction charges being thrown at GoDaddy for interfering with the investigation.
- p4bl0 13y agoIt is them. See the link in my response to crb above.
- msumpter 13y agoAnd it's Levison making the statement not GoDaddy. He's perfectly free to state one thing in public and do another in private. I may just be reading too much into the quotes from GoDaddy but in my mind none of them point to them definitively killing the certificate on their own.
- p4bl0 13y agoI may be naive, but I don't see why he would state such a thing rather than not saying anything if you were right. I also don't see why GoDaddy would put themselves in the middle of a court affair with the feds for nothing.
- yebyen 13y agoYou might not know this, but Mandrake (of Enlightenment WM and VA-Linux fame) is just recently now become in charge of computery people and things at GoDaddy. I hadn't thought to make the association until you put it out there, but he is a straight up hax0r, and I kind of expect that if his underlings hadn't already picked up the news and done this on their own, he would be momentarily busy reprimanding folks until they did. If we didn't know, it's one thing, but GoDaddy are not the ones who got the NSL in this case. So, why wouldn't they? Feds or no feds, GoDaddy's business is international and they are responsible to us all, just like ICANN. These companies/NGOs have been accused of being tools of the US government enough times without actually being accountable to the US Government (well, that's ICANN, I don't know about GoDaddy). I don't see it so much as striking back, as it's like... not being giant tools in a public forum kind of way.
- p4bl0 13y agoYep, that's why I submitted https://news.ycombinator.com/item?id=6526487 https://news.ycombinator.com/item?id=6526487 as soon as I saw it, I didn't see that one. It is Ladar Levison himself saying that GoDaddy did the revokation, not him.