Hacker News Reader

Comment by guelo | Hacker News Reader

DigiNotar's complete collapse is intriguing. Doing a little Googling I noticed that they just got acquired 8 months ago http://www.vasco.com/company/press_room/news_archive/2011/ac... That investment is not looking very good for Vasco right now.

It would be interesting to know the backstory here. I wouldn't be surprised if something about the acquisition caused all the engineers to jump ship. Their one press release seems to be begging the Dutch government to provide staff http://www.sacbee.com/2011/09/02/3881380/vasco-offers-dutch-...

View on HN

There was a live press conference on Dutch TV a few hours ago (“this broadcast is being interrupted…”) stating pretty much what’s written in this article:

An audit revealed that the government certificates may have been compromised and thus these have all been revoked. The government will take control over DigiNotar and will quickly replace all existing certificates.

It has now gotten to the point where Digid, the Dutch e-government single sign on has is basically saying "We're not secure" http://www.digid.nl/nieuws/artikel/artikel/89/. Very honest stance, and certificates are to be replaced.

For the backstory, this conference was at 00:30, and interrupting the public channels only happens when there's big news, plane crashes, etc.

They have put out a statement[1], although it's in Dutch. Assuming Google's translation conveys the gist and tone of it, they seem more irritated that the browser vendors are removing the root certificates than anything else.

[1] http://www.diginotar.nl/Actueel/tabid/264/articleType/Articl...

That is exactly what the article comes over as. They seem to be annoyed with the fact that their roots were being pulled when they claim only a single subroot was compromised.

They are willing to give people new certificates chained to the PKIOverheid, but that comes with the rules and requirements of those certs, and looking at later news it sounds like the Dutch government has revoked their access to that and will be taking over.

This:

"Gebruikers van SSL certificaten kunnen afhankelijk van de desbetreffende browserleverancier geconfronteerd worden met een mededeling dat het certificaat niet vertrouwd wordt. Dit is in 99,9% van de gevallen onjuist, het certificaat kan wel worden vertrouwd. Dit kan handmatig door de gebruiker zelf worden aangegeven in de browser (hiervoor kunt u terecht op de FAQ op onze website)."

Translates (roughly) to this:

Depending on the browsers a user of SSL certificates may be confronted with a message stating the certificate is not trusted. In 99.9% of the cases this is not correct, the certificate can be trusted. The user can do this manually using his browser (see our FAQ).

---

Given the situation I don't think that is the right message. I think people should not be told that 99.9% of certificates can be trusted even though their computer says no.

That's terrible that they're saying that. You would expect a CA to be the last person to try to educate others to ignore those warnings. It kind of undermines their whole reason of existence.

One explanation is that they just don't understand that.

Another is that they don't give a flip about their CA business at this point because it's just a liability to them that they wish would just go away.

If they're going to have any customer left after this it's going to be gov.nl, who seems to prefer having a pwned CA to re-rooting their whole PKI setup.

Other than gov.nl, their certs are only on a few hundred web servers. They likely didn't have the revenue to support even a single full-time person.

Their certs are also baked into hardware and a large part of the Dutch e-Government. Diginotar has more than 10 employees. They do other things than merely signing certs.

Size of the company doesn't really matter too. If it matters we would have a single CA.

Apparently even my new passport is signed by the Diginotar PKI. I'm wondering when this will be big news in Holland.

A full time person dedicated to the certificate business I was trying to say.

Reply on news.ycombinator.com