If you still trust WoSign's CA, time to nuke it from orbit. Apparently anyone can get a cert for GitHub now.https://twitter.com/pedromelo/status/770151127316885504 …
-
-
Replying to @marcan42
And remember, StartCom cross-signs WoSign, so you need to detrust both. Note that StartCom now uses Chinese infrastructure.
3 replies 32 retweets 18 likes -
Replying to @marcan42
More details on how WoSign and StartCom are being negligent in their duties as CAs:https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/k9PBmyLCi8I …
1 reply 18 retweets 10 likes -
Replying to @marcan42
It's kind of amazing how the WoSign guy's response is basically "oops, sorry, won't happen again". Amazing incident response/disclosure.
2 replies 2 retweets 4 likes -
Replying to @marcan42
WoSign issued not one, *two* GitHub certs: https://crt.sh/?id=29805567 https://crt.sh/?id=29647048 And they think no need to proactively revoke 0_o.
3 replies 11 retweets 4 likes -
Replying to @marcan42
This is comedy gold. WoSign is spamming Chinese Let's Encrypt users with FUD about "foreign CAs". Oh, the irony.https://groups.google.com/d/msg/mozilla.dev.security.policy/k9PBmyLCi8I/5Lelu0oyDQAJ …
1 reply 1 retweet 6 likes -
Replying to @marcan42
Meanwhile both WoSign's and StartCom's founders are using legal threats to suppress how WoSign bought StartCom:https://archive.is/QA61W
2 replies 1 retweet 3 likes
The aforelinked http://mozilla.dev.security .policy thread on this is drama gold. Incidents of negligence by WoSign just keep piling up.
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.