Hacker News new | ask | show | jobs
by brainscdf 2309 days ago
> Not that I expect Google to issue fake certs, but DigiNotar also doesn't command 80%+ browser marketshare to soften the blowback.

Not sure how that is relevant. DigiNotar was a trusted root CA in all major browsers. So if an attacker managed to get a fake certificate issued by DigiNotar, they could attack 100% of the users visiting the website for which the fake certificate was issued.

In fact, they did issue fake certificates by accident due to a security breach. As soon as the error was caught, their CA certificates were removed from all browsers. They went bankrupt! That's how serious this business of issuing certificates is.
1 comments
thenewnewguy 2309 days ago
It's relevant because Google isn't likely to remove _themselves_ from their browser, which is currently the most popular web browser on the planet.

For this reason alone, having a major browser dev as a CA is not a good idea, regardless of how much or little you trust google.

link
jacobparker 2309 days ago
Google is already a CA.

https://pki.google.com

link