The big news that didn’t make the news is back again, and yeah it’s gotten worse. Last week I wrote about a hack involving certificate authority Comodo—Is the system of trust on the Internet completely broken?—and talked about it in last week’s PrivacyNowRadio show—Privacy Now Radio Episode 2: Certificate hacks and questions of trust. Long story short, one of the “resellers” (for lack of a better term) of Comodo’s certificate signing products was hacked and fraudulent certificates for nine domains were created (all since revoked). This was bad enough, and while a hacker in Iran has claimed responsibility for the hack—Errata Security: The Comodo hacker releases his manifesto—we figured things were swinging back to “normal.”
Not so much.
Yesterday we learned that the FBI is looking into the attack (good)—FBI probes Comodo Web security breach—but today we learned that two, not just one, of Comodo’s resellers were breached—Comodo: Web attack broader than initially thought—ouch.
If we thought Comodo’s reputation was tarnished before, this is a whole different level of ugly. Essentially with Comodo’s model of allowing for fast and easy SSL certificate purchases (I can get a Comodo SSL certificate for about $10 with no paperwork involved), they’ve put us all at risk.
Should all Comodo certificates be invalidated? That would cause serious chaos on the Internet, not really an option. Should we seriously begin to look at how secure certificates are sold and issued?
Big time.
In the short time I think Comodo’s certificates should be considered potentially suspect until they can prove that their security is up to snuff. Harsh, yes, but the system of signed certificates is based on trusting the signer/issuer of the certificate and right now Comodo is losing that trust.
Sure I’d love to be able to buy a cheap SSL certificate to secure signing on to my blogs’ control panels, but by supporting cheap certificates, we support cheap security and none of us can afford that.