Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Incorrect. DigiNotar[1] was permanently removed.

Quoting Mozilla[2]: "This is not a temporary suspension, it is a complete removal from our trusted root program."

[1]: https://en.wikipedia.org/wiki/DigiNotar#Issuance_of_fraudule...

[2]: https://blog.mozilla.org/security/2011/09/02/diginotar-remov...



They were removed for being compromised and went bankrupt before trying again. I don't see how that invalidates what I said.

Meanwhile, CAs that have issued CA=yes certs remain, but you know, Mozilla wrote them a letter reminding them on security best practices.


True that they went bankrupt, but they filed on Sep 20th 2011, and the Mozilla decision to permanently remove them was a week prior or at least on Sep 2nd 2011; thus "unless you were compromised, at which point they'll happily add your new CA" is not correct.

EDIT: To clearify, this is the phrase that we seem to be arguing about: Complete revocation of trust is a decision we treat with careful consideration, and employ as a last resort. (from the Mozilla Security Blog link above).

They were effectively out in the cold, not "in once you're in" after the incident.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: