[Someone1234]

> I’ve been sitting on this information for some time, waiting to get more research done before I publish a post.

You've been sitting on common knowledge for some time? Research into what?

Sorry but this is a very well known issue with HTTPS that has been discussed in depth for the last few years, in particular with people suggesting alternatives and improvements to HTTPS (like certificate pinning, Convergence[0], etc).

The fact the author thinks they have found some type of unknown or smoking gun says more about the author than anything. I mean heck you can go back and find tons of examples of root CAs "mistakenly" generating fake certificates for things like Google or Windows Update. You can also read about entire countries being victim of it [1].

[0] http://convergence.io/ [1] http://www.bbc.com/news/technology-14789763

[mike_hearn]

If by "tons" you mean, like, once, then sure.

I don't think that's a very helpful way to look at it though. The PKI system has been around for 20 years, was designed to stop credit card theft, and we can sum up the number of times it's been seriously breached on the fingers of one hand.

Many other security systems have failure rates measured in percent, so I don't think it's doing so badly.

[itistoday2]

We keep a running comparison of one such solution (DNSChain) to many other proposals folks have made (including Convergence, Perspectives, Certificate Transparency, DNSSEC, TACK, HPKP):

https://github.com/okTurtles/dnschain/blob/master/docs/Compa...