[liberationtech] Another CA Compromise: TurkTrust

[Julian Oliver]

..on Fri, Jan 04, 2013 at 03:09:41AM +0200, Nadim Kobeissi wrote:
> Another CA has been found issuing SSL certificates for Google services.
> Mozilla has acted on the issue:
> https://blog.mozilla.org/security/2013/01/03/revoking-trust-in-two-turktrust-certficates/
> 
> The weird thing is that it's starting to appear less and less crazy to just
> get rid of the CA system and replace it with… nothing. What do you guys
> think?

This is where I like Moxie's approach with Convergence very much, albeit I
haven't had a whole lot of luck with it (in BETA) so far. 

    http://convergence.io/index.html

SSL/TLS is a fairly fundamental part of the transport layer infrastructure these
days - hard to shake it! But yes indeed, it's insane that we're trusting these
random companies to look after their end of the bargain, let alone the browsers
vendors that trust them in turn. 

Cheers,

-- 
Julian Oliver
http://julianoliver.com
http://criticalengineering.org