If you still trust WoSign's CA, time to nuke it from orbit. Apparently anyone can get a cert for GitHub now.https://twitter.com/pedromelo/status/770151127316885504 …
-
And remember, StartCom cross-signs WoSign, so you need to detrust both. Note that StartCom now uses Chinese infrastructure.
More details on how WoSign and StartCom are being negligent in their duties as CAs:https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/k9PBmyLCi8I …
-
-
It's kind of amazing how the WoSign guy's response is basically "oops, sorry, won't happen again". Amazing incident response/disclosure.
-
preeeeeetty sure CAs should have a *touch* more responsibility of disclosure than that... :|
- Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.