Google warns of unauthorized TLS certificates trusted by almost all OSes
(Ars):
http://arstechnica.com/security/2015/03/google-warns-of-unauthorized-tls-certificates-trusted-by-almost-all-oses/
"The bogus transport layer security certificates are trusted by all
major operating systems and browsers, although a fall-back mechanism
known as public key pinning prevented the Chrome and Firefox browsers
from accepting those that vouched for the authenticity of Google
properties, Google security engineer Adam Langley wrote in a blog post
published Monday. The certificates were issued by Egypt-based MCS
Holdings, an intermediate certificate authority that operates under
the China Internet Network Information Center (CNNIC). The Chinese
domain registrar and certificate authority, in turn, is included in
root stores for virtually all OSes and browsers. The issuance of the
unauthorized certificates represents a major breach of rules
established by certificate authorities and browser makers."
- - -
The only thing missing that keeps this from being a true "Groundhog Day"
experience is "I Got You Babe" playing every morning at 6 AM.
--Lauren--
Lauren Weinstein ([email protected]): http://www.vortex.com/lauren
Founder:
- Network Neutrality Squad: http://www.nnsquad.org
- PRIVACY Forum: http://www.vortex.com/privacy-info
Co-Founder: People For Internet Responsibility: http://www.pfir.org/pfir-info
Member: ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com
Google+: http://google.com/+LaurenWeinstein
Twitter: http://twitter.com/laurenweinstein
Tel: +1 (818) 225-2800 / Skype: vortex.com
_______________________________________________
pfir mailing list
http://lists.pfir.org/mailman/listinfo/pfir
