3 ms·
There's tons of CAs that can subvert security for most sites using SSL but also, if any of those CAs are caught issuing a bogus cert, which the cert presented t
by MertsA 12y ago
There's tons of CAs that can subvert security for most sites using SSL but also, if any of those CAs are caught issuing a bogus cert, which the cert presented to the user is proof of, they will be immediately blacklisted like DigiNotar and suddenly a whole CA is gone just for getting caught using it once.
- throwaway7767 12y agoAnd yet, TrustWave gets to keep their certificate despite doing the same thing intentionally (as opposed to accidentally through incompetence). The system does not work.
- verytrivial 12y agoCatching one of these forged certs "in the wild" is harder if it only ever appears on the targets connection. If they happen to be anyone other than the fraction of a percent of users who understand things like "pinning", it is very low risk (today at least). The ability to generate a CA cert trusted by a consumer CA store is a valuable asset that, like any intel asset, must be rationally deployed.