Hacker News Reader

Comment by NelsonMinar | Hacker News Reader

Comodo is not a trustworthy security company.

Their browser extensions break browser security: https://news.ycombinator.com/item?id=11021633 https://news.ycombinator.com/item?id=9091917

They issued fraudulent SSL certificates in 2011: https://www.schneier.com/blog/archives/2011/03/comodo_group_...

View on HN

> They issued fraudulent SSL certificates in 2011: https://www.schneier.com/blog/archives/2011/03/comodo_group_...

Moxie had an amusing anecdote about this incident in his Blackhat 2011 talk "SSL and the future of authenticity"[0]. Apparently the same IP as was used by the "sophisticated attacker" and disclosed by Comodo downloaded sslsniff[1] from moxies server the next day, referred by a video tutorial about intercepting SSL..

0: https://youtu.be/Z7Wl2FW2TcA?t=5m

1: https://moxie.org/software/sslsniff/

Thanks, this video really made my day! :) I guess I won't be buying certificates from Comodo anytime soon.

If they're not trustworthy, let's remove them from the trusted CA lists of major FOSS browsers / distros. Anyone know the proper mailing list / bugtracker this should be filed on in the case of Firefox?

While a worthy cause, Firefox would be utterly broken if Comodo was no longer a trusted CA.

Just how many use Comodo, and why isn't there some sort of movement pushing against Comodo? Hopefully if they lose business or start to they will think twice and attempt to restructure everything.

CloudFlare uses them for Universal SSL, so that's roughly 5% of all websites[1]. Their overall market share (in the CA business) appears to be around 40%[2].

[1]: https://w3techs.com/technologies/details/cn-cloudflare/all/a...

[2]: https://w3techs.com/technologies/overview/ssl_certificate/al...

Oh, CloudFlare uses them. That's quite a market share. It is sad that they have such a bad reputation... Hopefully someone buys them out who restructures them or something....

An alternative option is to petition CloudFlare to switch Certificate Authorities and hit Comodo where it hurts - in their wallet.

Hacker news uses Comodo as their CA.

I didn't even notice. I guess they're a bigger fish than I ever realized.

At least hn should switch to letsencrypt after the douchebaggery from comodo.

Sounds like we need a new type of TLS warning:

> While this site's certificate is technically valid, it was issued by an untrustworthy (citation) agency (link to Comodo).

Awesome idea, couple years ago I dropped the few certs I had with Comodo after all their malpractices.

This should be included as a warning for every website that has their cert: https://en.wikipedia.org/wiki/Comodo_Group#Controversies

Followup idea: a trusted neutral 3rd party that ranks CAs by various factors, such as controversiality. Quotes Wikipedia and other (arguably) objective sources [of fact] and welcomes debate about potential bias.

Perhaps this group could publish reports periodically so that they can then be picked up and bundled into browsers - that way you're not constantly sending [trackable] cert requests to a 3rd party, and you already have the cert info so there's no query server to DDoS.

Maybe Firefox could incorporate it into the TLS info popup and possibly the HTTPS icon... Chrome never would; this idea goes way too close to the advertising industry.

An extension would be nice, but something like this would never go viral so would never get adoption. Native browser integration would be a must.

Also, mozilla.org's cert is by DigiCert. What's their track record?

If their not security worthy can't the browsers just Barr them? There should be a nice democratic way of punishing the abusive behaviors.

Reply on news.ycombinator.com