Flutterby™! : Windows Update to revoke certs

Next unread comment / Catchup all unread comments User Account Info | Logout | XML/Pilot/etc versions | Long version (with comments) | Weblog archives | Site Map | | Browse Topics

Windows Update to revoke certs

2014-07-11 14:13:09.997144+00 by Dan Lyke 0 comments

More evidence that the CA system is broken: Emergency Windows update revokes dozens of bogus Google, Yahoo SSL certificates:

Thursday's unscheduled update effectively blocks 45 highly sensitive secure sockets layer (SSL) certificates that hackers managed to generate after compromising systems operated by the National Informatics Centre (NIC) of India. That's an intermediate certificate authority (CA) whose certificates were automatically trusted by all supported versions of Windows. Millions of sites operated by banks, e-commerce companies, and other types of online services use such cryptographic credentials to encrypt data passing over the open Internet and to prove the authenticity of their servers. As Ars explained Wednesday, the counterfeit certificates pose a risk to Windows users accessing SSL-protected sections of Google, Yahoo, and any other affected domains.

Should have probably revoked the cert of the intermediate CA a lot faster, but...

[ related topics: Microsoft Net Culture Cryptography ]

comments in ascending chronological order (reverse):