3 ms·

That is simply not true: http://googleonlinesecurity.blogspot.co.uk/2011/08/update-on-attempted-man-in-middle.html http://googleonlinesecurity.blogspot.co.uk/2

That is simply not true: http://googleonlinesecurity.blogspot.co.uk/2011/08/update-on-attempted-man-in-middle.html http://googleonlinesecurity.blogspot.co.uk/2011/08/update-on...

pornel 12y ago
OTOH Comodo is still in business: http://www.wired.com/2011/03/comodo-compromise/ http://www.wired.com/2011/03/comodo-compromise/
- abritishguy 12y ago
  I was wrong.
  - mike_hearn 12y ago
    DigiNotar got revoked partly because they got hacked, but mostly because they had zero acceptable followup. There was no good enough postmortem describing their mistakes and how they would correct them, and they also engaged in a coverup. Browser makers do not engage in instant execution of any CA that makes a mistake, because CA's are run by humans and to err is human. What they insist on is coming clean when mistakes are made, and steps taken ASAP to restore confidence, like publishing a real post mortem and making business changes to ensure the same mistake can't happen again.
wiml 12y ago
My mistake. I'd been under the impression that the discussion of removing Diginotar from the trust list had fizzled, like Trustwave's did [1,2]. It's good to learn that I was wrong. There are counterexamples, though. Comodo[3] and Verisign[4] are still in the trust store— they're too big to fail, I expect. [1] http://www.computerworld.com/s/article/9224082/Trustwave_admits_issuing_man_in_the_middle_digital_certificate_Mozilla_debates_punishment http://www.computerworld.com/s/article/9224082/Trustwave_adm... [2] https://bugzilla.mozilla.org/show_bug.cgi?id=724929 https://bugzilla.mozilla.org/show_bug.cgi?id=724929 [3] http://www.wired.com/2011/03/comodo-compromise/ http://www.wired.com/2011/03/comodo-compromise/ [4] https://www.schneier.com/blog/archives/2012/02/verisign_hacked.html https://www.schneier.com/blog/archives/2012/02/verisign_hack...

That is simply not true: http://googleonlinesecurity.blogspot.co.uk/2011/08/update-on-attempted-man-in-middle.html http://googleonlinesecurity.blogspot.co.uk/2011/08/update-on...

pornel 12y ago

OTOH Comodo is still in business: http://www.wired.com/2011/03/comodo-compromise/ http://www.wired.com/2011/03/comodo-compromise/

abritishguy 12y ago
I was wrong.
- mike_hearn 12y ago
  DigiNotar got revoked partly because they got hacked, but mostly because they had zero acceptable followup. There was no good enough postmortem describing their mistakes and how they would correct them, and they also engaged in a coverup. Browser makers do not engage in instant execution of any CA that makes a mistake, because CA's are run by humans and to err is human. What they insist on is coming clean when mistakes are made, and steps taken ASAP to restore confidence, like publishing a real post mortem and making business changes to ensure the same mistake can't happen again.

wiml 12y ago

My mistake. I'd been under the impression that the discussion of removing Diginotar from the trust list had fizzled, like Trustwave's did [1,2]. It's good to learn that I was wrong. There are counterexamples, though. Comodo[3] and Verisign[4] are still in the trust store— they're too big to fail, I expect. [1] http://www.computerworld.com/s/article/9224082/Trustwave_admits_issuing_man_in_the_middle_digital_certificate_Mozilla_debates_punishment http://www.computerworld.com/s/article/9224082/Trustwave_adm... [2] https://bugzilla.mozilla.org/show_bug.cgi?id=724929 https://bugzilla.mozilla.org/show_bug.cgi?id=724929 [3] http://www.wired.com/2011/03/comodo-compromise/ http://www.wired.com/2011/03/comodo-compromise/ [4] https://www.schneier.com/blog/archives/2012/02/verisign_hacked.html https://www.schneier.com/blog/archives/2012/02/verisign_hack...