3 ms·

Experience shows that there are no repercussions [edit: usually no repercussions] if a commercial CA is hacked, either (or even if it intentionally issues fraud

by wiml 13y ago

Experience shows that there are no repercussions [edit: usually no repercussions] if a commercial CA is hacked, either (or even if it intentionally issues fraudulent certificates).

dfc 13y ago
Distrust Diginotar certificate: https://bugzilla.mozilla.org/show_bug.cgi?id=682927 https://bugzilla.mozilla.org/show_bug.cgi?id=682927
abritishguy 13y ago
That is simply not true: http://googleonlinesecurity.blogspot.co.uk/2011/08/update-on-attempted-man-in-middle.html http://googleonlinesecurity.blogspot.co.uk/2011/08/update-on...
- pornel 13y ago
  OTOH Comodo is still in business: http://www.wired.com/2011/03/comodo-compromise/ http://www.wired.com/2011/03/comodo-compromise/
  - abritishguy 13y ago
    I was wrong.
    - mike_hearn 13y ago
      DigiNotar got revoked partly because they got hacked, but mostly because they had zero acceptable followup. There was no good enough postmortem describing their mistakes and how they would correct them, and they also engaged in a coverup. Browser makers do not engage in instant execution of any CA that makes a mistake, because CA's are run by humans and to err is human. What they insist on is coming clean when mistakes are made, and steps taken ASAP to restore confidence, like publishing a real post mortem and making business changes to ensure the same mistake can't happen again.
- wiml 13y ago
  My mistake. I'd been under the impression that the discussion of removing Diginotar from the trust list had fizzled, like Trustwave's did [1,2]. It's good to learn that I was wrong. There are counterexamples, though. Comodo[3] and Verisign[4] are still in the trust store— they're too big to fail, I expect. [1] http://www.computerworld.com/s/article/9224082/Trustwave_admits_issuing_man_in_the_middle_digital_certificate_Mozilla_debates_punishment http://www.computerworld.com/s/article/9224082/Trustwave_adm... [2] https://bugzilla.mozilla.org/show_bug.cgi?id=724929 https://bugzilla.mozilla.org/show_bug.cgi?id=724929 [3] http://www.wired.com/2011/03/comodo-compromise/ http://www.wired.com/2011/03/comodo-compromise/ [4] https://www.schneier.com/blog/archives/2012/02/verisign_hacked.html https://www.schneier.com/blog/archives/2012/02/verisign_hack...

by wiml 13y ago

Experience shows that there are no repercussions [edit: usually no repercussions] if a commercial CA is hacked, either (or even if it intentionally issues fraudulent certificates).

dfc 13y ago

Distrust Diginotar certificate: https://bugzilla.mozilla.org/show_bug.cgi?id=682927 https://bugzilla.mozilla.org/show_bug.cgi?id=682927

abritishguy 13y ago

That is simply not true: http://googleonlinesecurity.blogspot.co.uk/2011/08/update-on-attempted-man-in-middle.html http://googleonlinesecurity.blogspot.co.uk/2011/08/update-on...

pornel 13y ago
OTOH Comodo is still in business: http://www.wired.com/2011/03/comodo-compromise/ http://www.wired.com/2011/03/comodo-compromise/
- abritishguy 13y ago
  I was wrong.
  - mike_hearn 13y ago
    DigiNotar got revoked partly because they got hacked, but mostly because they had zero acceptable followup. There was no good enough postmortem describing their mistakes and how they would correct them, and they also engaged in a coverup. Browser makers do not engage in instant execution of any CA that makes a mistake, because CA's are run by humans and to err is human. What they insist on is coming clean when mistakes are made, and steps taken ASAP to restore confidence, like publishing a real post mortem and making business changes to ensure the same mistake can't happen again.
wiml 13y ago
My mistake. I'd been under the impression that the discussion of removing Diginotar from the trust list had fizzled, like Trustwave's did [1,2]. It's good to learn that I was wrong. There are counterexamples, though. Comodo[3] and Verisign[4] are still in the trust store— they're too big to fail, I expect. [1] http://www.computerworld.com/s/article/9224082/Trustwave_admits_issuing_man_in_the_middle_digital_certificate_Mozilla_debates_punishment http://www.computerworld.com/s/article/9224082/Trustwave_adm... [2] https://bugzilla.mozilla.org/show_bug.cgi?id=724929 https://bugzilla.mozilla.org/show_bug.cgi?id=724929 [3] http://www.wired.com/2011/03/comodo-compromise/ http://www.wired.com/2011/03/comodo-compromise/ [4] https://www.schneier.com/blog/archives/2012/02/verisign_hacked.html https://www.schneier.com/blog/archives/2012/02/verisign_hack...