Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.
    Tweeted twitter.com/#!/StackSecurity/status/110966517184724992
2 link to report with details on the DigiNotar hack
source | link

Recently the DigiNotar CA was hacked, and rogue certificates were issued. Since they also issue certificates on behalf of the Dutch government, the government made a statement about it as well, basically claiming: 'don't visit the website if you get a security warning from your browser'. Good advice in itself, and better than DigiNotar itself which claims 'ignoring that warning is 99.9% safe', but it ignores browsers with CA trust stores which have not been updated yet.

Assuming a non-updated browser (trust store), isn't a user vulnerable for Man-In-The-Middle attacks on any website, not just the ones which had a valid DigiNotar certificate? I know you can check the certificate chain on a website, but I never do, and I know for sure my parents never do.

Is SSL-trust really only as strong as the weakest CA, and is there a way to fix that?

Update 2011-09-06: An independent report by Fox-IT on the DigiNotar hack was made public

Recently the DigiNotar CA was hacked, and rogue certificates were issued. Since they also issue certificates on behalf of the Dutch government, the government made a statement about it as well, basically claiming: 'don't visit the website if you get a security warning from your browser'. Good advice in itself, and better than DigiNotar itself which claims 'ignoring that warning is 99.9% safe', but it ignores browsers with CA trust stores which have not been updated yet.

Assuming a non-updated browser (trust store), isn't a user vulnerable for Man-In-The-Middle attacks on any website, not just the ones which had a valid DigiNotar certificate? I know you can check the certificate chain on a website, but I never do, and I know for sure my parents never do.

Is SSL-trust really only as strong as the weakest CA, and is there a way to fix that?

Recently the DigiNotar CA was hacked, and rogue certificates were issued. Since they also issue certificates on behalf of the Dutch government, the government made a statement about it as well, basically claiming: 'don't visit the website if you get a security warning from your browser'. Good advice in itself, and better than DigiNotar itself which claims 'ignoring that warning is 99.9% safe', but it ignores browsers with CA trust stores which have not been updated yet.

Assuming a non-updated browser (trust store), isn't a user vulnerable for Man-In-The-Middle attacks on any website, not just the ones which had a valid DigiNotar certificate? I know you can check the certificate chain on a website, but I never do, and I know for sure my parents never do.

Is SSL-trust really only as strong as the weakest CA, and is there a way to fix that?

Update 2011-09-06: An independent report by Fox-IT on the DigiNotar hack was made public

1
source | link

What are the risks of a Certificate Authority hack for 'the average user'?

Recently the DigiNotar CA was hacked, and rogue certificates were issued. Since they also issue certificates on behalf of the Dutch government, the government made a statement about it as well, basically claiming: 'don't visit the website if you get a security warning from your browser'. Good advice in itself, and better than DigiNotar itself which claims 'ignoring that warning is 99.9% safe', but it ignores browsers with CA trust stores which have not been updated yet.

Assuming a non-updated browser (trust store), isn't a user vulnerable for Man-In-The-Middle attacks on any website, not just the ones which had a valid DigiNotar certificate? I know you can check the certificate chain on a website, but I never do, and I know for sure my parents never do.

Is SSL-trust really only as strong as the weakest CA, and is there a way to fix that?