Re: Certificates with invalidly long serial numbers

2017-08-09 Thread Matt Palmer via dev-security-policy
On Wed, Aug 09, 2017 at 04:21:19PM +0200, Jakob Bohm via dev-security-policy wrote: > On 08/08/2017 20:46, Alex Gaynor wrote: > > It's from the BRs 4.9.1.1: > > > > The CA SHALL revoke a Certificate within 24 hours if one or more of > > the following occurs: > > > > It's also not a penalty

Re: 2017.08.10 Let's Encrypt Unicode Normalization Compliance Incident

2017-08-13 Thread Matt Palmer via dev-security-policy
On Fri, Aug 11, 2017 at 06:32:11PM +0200, Kurt Roeckx via dev-security-policy wrote: > On Fri, Aug 11, 2017 at 11:48:50AM -0400, Ryan Sleevi via dev-security-policy > wrote: > > On Fri, Aug 11, 2017 at 11:40 AM, Nick Lamb via dev-security-policy < > > dev-security-policy@lists.mozilla.org> wrote:

Re: Certificates with less than 64 bits of entropy

2017-08-18 Thread Matt Palmer via dev-security-policy
On Fri, Aug 18, 2017 at 04:04:48PM +, Stephen Davidson via dev-security-policy wrote: > Siemens has previously indicated that the affected certificates are > installed on high profile websites and infrastructure for Siemen’s group > companies around the world, and that a rushed revocation woul

Re: PROCERT issues

2017-10-05 Thread Matt Palmer via dev-security-policy
On Thu, Oct 05, 2017 at 11:05:07AM +0800, Gervase Markham via dev-security-policy wrote: > In addition, we do need to address the question of how we can ascertain > that the organization has acquired the technical competence and > management rigour which seems to be lacking. I know you have placed

Re: Efficient test for weak RSA keys generated in Infineon TPMs / smartcards

2017-10-16 Thread Matt Palmer via dev-security-policy
On Mon, Oct 16, 2017 at 09:14:29PM +0100, Rob Stradling via dev-security-policy wrote: > On 16/10/17 20:01, Matthew Hardeman via dev-security-policy wrote: > > The authors of the paper on the weak RSA keys generated by Infineon TPMs > > and smart cards have published code in multiple languages /

Re: Swiss Government root inclusion request

2017-11-22 Thread Matt Palmer via dev-security-policy
On Thu, Nov 23, 2017 at 06:43:42AM +, =?utf-8?q?Michael_von_Niederh=C3=A4usern_via_dev-security-policy_=3Cd?=@lists.mozilla.org wrote: > - 2.2(3) says: " The CA's CP/CPS must clearly specify the procedure(s) that > the CA employs, and each documented procedure should state which subsection

Re: On the value of EV

2017-12-13 Thread Matt Palmer via dev-security-policy
On Wed, Dec 13, 2017 at 05:58:38PM +, Tim Shirley via dev-security-policy wrote: > So many of the arguments made here, such as this one, as well as the > recent demonstrations that helped start this thread, focus on edge cases. > And while those are certainly valuable to consider, they obscur

Re: On the value of EV

2017-12-13 Thread Matt Palmer via dev-security-policy
On Wed, Dec 13, 2017 at 01:40:35PM -0800, Matthew Hardeman via dev-security-policy wrote: > I'm not sure we need namespace separation for EV versus non-EV subresouces. > > The cause for this is simple: > > It is the main page resource at the root of the document which causes each > sub-resource

Re: On the value of EV

2017-12-13 Thread Matt Palmer via dev-security-policy
On Thu, Dec 14, 2017 at 12:21:12AM +, Tim Hollebeek via dev-security-policy wrote: > If you look at the phishing data feeds and correlate them with EV > certificates, > you'll find out that Tim's "speculation" is right. Ladies and gentlemen, this evening, for your viewing pleasure, the music

Re: On the value of EV

2017-12-15 Thread Matt Palmer via dev-security-policy
On Fri, Dec 15, 2017 at 08:34:37AM +0100, Jakob Bohm via dev-security-policy wrote: > YOU in particularly have kept insisting that it is a "myth" that > phishing sites don't use EV certificates, yet keep pointing to articles > about non-EV failures. As the Wikipedians say, "Citation Needed". I d

<    1   2   3