If you still trust WoSign's CA, time to nuke it from orbit. Apparently anyone can get a cert for GitHub now.https://twitter.com/pedromelo/status/770151127316885504 …
-
-
Replying to @marcan42
And remember, StartCom cross-signs WoSign, so you need to detrust both. Note that StartCom now uses Chinese infrastructure.
3 replies 32 retweets 18 likes -
Replying to @marcan42
More details on how WoSign and StartCom are being negligent in their duties as CAs:https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/k9PBmyLCi8I …
1 reply 18 retweets 10 likes -
Replying to @marcan42
It's kind of amazing how the WoSign guy's response is basically "oops, sorry, won't happen again". Amazing incident response/disclosure.
2 replies 2 retweets 4 likes -
Replying to @marcan42
WoSign issued not one, *two* GitHub certs: https://crt.sh/?id=29805567 https://crt.sh/?id=29647048 And they think no need to proactively revoke 0_o.
3 replies 11 retweets 4 likes -
Replying to @marcan42
This is comedy gold. WoSign is spamming Chinese Let's Encrypt users with FUD about "foreign CAs". Oh, the irony.https://groups.google.com/d/msg/mozilla.dev.security.policy/k9PBmyLCi8I/5Lelu0oyDQAJ …
1 reply 1 retweet 6 likes -
Replying to @marcan42
Meanwhile both WoSign's and StartCom's founders are using legal threats to suppress how WoSign bought StartCom:https://archive.is/QA61W
2 replies 1 retweet 3 likes
WoSign's incident report is just pure hilarity. Actual quote: "Hi two beautiful girls". https://www.wosign.com/report/wosign_incidents_report_09042016.pdf …
-
-
Replying to @marcan42
did they seriously blame the GitHub cert issue on TOU violation?
1 reply 0 retweets 1 like -
Replying to @littlesteve
Oh yes they did. Bugs don't count as long as you have a checkbox for TOU!
1 reply 0 retweets 0 likes - Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.