Re: Detecting Certificate Authority compromises and web browser collusion

[Valdis Kletnieks <Valdis.Kletnieks () VT EDU>]

On Thu, 24 Mar 2011 23:21:46 CDT, Jesse Thompson said:

> > A short summary of the story: A Comodo reseller account was compromised
> > and some certificates were issued that could be used to spoof high-value
> > websites. Comodo has revoked the certificates and communicated details
> > of the incident in a blog post (see below).
>
> Although, I do find it interesting that "Comodo has revoked the 
> certificates" carries little weight if you follow the author's argument 
> that the certificate revocation system is ineffective.

I heard mention that the fact that no requests for the CRL list had been
received was used as an indication that the certificates had not been used. I
won't name the offenders, so they get a freebie chance to walk that one back
before anybody notices...

Attachment: _bin
Description: