YHK - yet another hacker news clone

1. 59 million of those 60 million could be very short validity, duplicate enrollments from same private key/csr, etc. 2. I'm still not certain that that figure isn't including for example private roots/intermediates they've issued from.

That said they're a low volume (in terms of root/int) provider so I don't think the impact of them exiting will be great.

What does this mean from the press release? Were they only issuing other chained intermediates? Or did they never issue any ECC certificates from these at all, and everyone is paying the price?

I wonder if big roots with chained intermediates will now need to have serious pressure on their downstream intermediates to re-prove their need to exist. I know RHEL and Debian's strategy (if not others) was to pull the Comodo AAA Services root as well ...

Or silently spin out a subsidiary under a new name who takes over the cert business, and redirect existing customers there for renewals.

Absolutely no way any OS or browser manufacturer forgives them and let's their certs validate anything in the future.

4

The key needs to mention which curve it is using.

Also note that using small numbers like 65537 for RSA public exponents is common practice.

e.g. Japanese culture in many circumstances requires a company to rush to apologize for the smallest perceived (not even actual) fault

learn about Izzat and Jugaad in their "culture". That explains the problem itself, as well as the reaction ;)

It raises the question why these CAs agree to participate on this forum and then complain about doing so.

1: https://bugzilla.mozilla.org/show_bug.cgi?id=1950144

The statement can use whatever weasel words it likes, but the action pretty clearly says "we aren't mature enough as an organisation to handle this responsibility." Which would be quite the concern for me, if I were a customer for one of eMudhra's other product lines.

You apparently don't understand Indians.

I see this more as "we didn't know this was so complex and the juice no longer looks worth the squeeze."

But at the end of the day if you're not prepared to revoke the trust of any CA you trust, it's a you problem

It might even be sensible to intentionally revoke a small number of certificates every month, to make sure nobody is complacent.

My trust in those vetting the CAs is completely broken now.

That’s sort of the problem the CA forum (badly) addresses. The consumers of the CAs are not specifically exposed to failures of the CA they choose.

One man's "little known company with no cybersecurity muscle" is another one's "sovereign certificate infrastructure."

They just didn't mention that now anyone can be their own Certificate Authority.

The best example I can think is (some) international borders: yeah, they're heavily regulated entities with lots of written protections (and thousands of miles of impenitrable barricades), but occassionally a hole opens up (whether physically or engineered).

Perhaps a section of border fence is occassionally destroyed (and people sneak in), but this won't happen if the border guards are approving [false] passports from a compromised government actor ("they have a valid passport, according to our inspection"), the border fence doesn't even matter!

Presume anybody can now go to that bad-passport-issuing government and request a passport to then enter any other country (i.e. the other country will see the passport as valid in the official global database): BAM, borders no longer mean anything; welcome to Privileged Accessia.

house collapses and people get injured.

concrete manufacture says we no longer build houses cause it’s too small of a business.

Normally, the king would declare and sign a proc stating that anything signed by his secretary's "unforgeable" signet was to be respected as well. The secretary could delegate authority to others in turn.

Well turns out that one of the signets in the chain of trust was just a picture of a "four" that anybody could have forged, but nobody noticed because in all of the ceremony and stacks of parchment with wax seals, nobody actually checked if the signet was secure.

Really though, this is no different than people relying on accountancy firms in the rest of the world for "trust" and "security" as technology concepts. Accountancy firms have no business consulting on technology topics, and yet that is a major part of their business all over the world, because we've allowed "security" and "compliance" to become muddled concepts.

First one I clicked on?