On 09/09/11 20:06 -0700, Michael DeMan wrote:
Sorry for being ignorant here - I have not even been aware that it is
possible to buy a '*.*.com' domain at all.
I though wildcards were limited to having a domain off a TLD - like
'*.mydomain.tld'.
Is it true that the my browser on a windows, mac, or linux desktop may
have listed as trusted authorities, an outfit that sells '*.*.tld' ?
The issue is that a trusted third party's (Diginotar) trusted signing
certificate was stolen, allowing the holder to create and sign whatever
certificates he wished, which don't necessarily need to be wildcard certs
to be effective.
Certificate signers are not restricted to any domain hierarchy (a design
feature of x.509 pki), which means that *any* trusted stolen signing
certificate can wreak havok on the trusted nature of x.509.
Even the hint that the claimed Diginotar cracker has gotten her hands
on several other signing certificates may be significant motivation to find
a replacement for the existing x.509 based pki.
On Sep 9, 2011, at 2:54 PM, Paul wrote:
On 09/09/2011 11:48 AM, Marcus Reid wrote:
On Wed, Sep 07, 2011 at 09:17:10AM -0700, Network IP Dog wrote:
FYI!!!
http://seattletimes.nwsource.com/html/microsoftpri0/2016132391_microsoft_dee
ms_all_diginotar_certificates_untrust.html
Google and Mozilla have also updated their browsers to block all DigiNotar
certificates, while Apple has been silent on the issue, a emblematic zombie
response!
Apple has sent out a notification saying that they are removing
DigiNotar from their list of trusted root certs.
I like this response; instant CA death penalty seems to put the
incentives about where they need to be.
Marcus
Instant? This has been going on for over a week, and a lot of damage could
have been done in that time, especially given certs for *.*.com were signed
against Diginotar. Most cell phones are unable to update their certificates
without an upgrade and you know how long it takes to get them through Cell
Phone carriers. A number of alternative android builds are adding the ability
to control accepted root certs to their builds in the interest of speeding this
up. The CA system is fundamentally flawed.
Paul
--
Dan White
