MetaFilter posts tagged with CertificateAuthority

Decentralized SSL Observatory

jeffburdges — Wed, 29 Feb 2012 19:32:04 -0800

EFF's HTTPS Everywhere v2 adds support for Chrome and adds Decentralized SSL Observatory to the FireFox version, SSL Observatory helps cryptographic researchers find implementation problems and now warns users when known problems are detected. And it plays nicely with Tor of course. There is another interesting EFF project in the works called Sovereign Keys that seeks to replace the certificate authority system entirely, which has proven leaky. It appears the EFF aren't the only ones looking to replace the certificate authorities.

Comodo Registration Authority compromised

fifteen schnitzengruben is my limit — Thu, 24 Mar 2011 20:05:13 -0800

The circumstantial evidence suggests that the attack originated in Iran. Every time you see a little lock icon in your browser and are using HTTPS connections, odds are you're using a site whose certificate was signed by an Certificate Authority like VeriSign, Comodo, or Thawte. This week, SSL certificate provider Comodo announced that one of its accounts had been compromised. The attacker used the account to generate 9 bogus certificates to use for 7 well-known domains. While the breach was discovered and the certificates were revoked, it does raise questions about the chain of trust for all SSL certificates. The sites that the attacker created false IDs for were main internet hubs like Google, Yahoo, Skype, and Live. As Comodo posted in their blog: It does not escape notice that the domains targeted would be of greatest use to a government attempting surveillance of Internet use by dissident groups. The attack comes at a time when many countries in North Africa and the Gulf region are facing popular protests and many commentators have identified the Internet and in particular social networking sites as a major organizing tool for the protests.

Stir in poisoned DNS and add a dash of transparent proxying...

These Premises Are Alarmed — Tue, 30 Dec 2008 08:44:20 -0800

The embargo has been lifted on the newest research on growing internet infrastructure insecurity. Using an army of Playstations, researchers have managed to forge a RapidSSL (owned by Verisign) CA certificate in a couple hours due to known flaws in MD5.