Hacker News Reader

Google cares that governments aren't man-in-the-middling their web browser when talking to their online services.

That's how the DigiNotar breach was publicly disclosed. The browser/CA CAB forum knew about it and had been hiding it for weeks until an actual Chrome user posted a message in the Gmail support forum: https://www.google.com/support/forum/p/gmail/thread?tid=2da6...

View on HN

> The browser/CA CAB forum knew about it and had been hiding it for weeks

That's really criminal.

.. which perhaps calls for collectively mette punishment.

DigiNotar knew about and hid the attack. I don't believe there is any evidence that the CA/Browser Forum knew about the attack until it was made public.

Right. Well the attacks (and emergency revocations) go back at least to March with Comodo. Vasco/Diginotar had auditors and outside security consultants in June. Maybe not CAB Forum per se, but I'm not so sure I believe that no one was notified of anything. There are likely some serious contractual disclosure obligations there, perhaps even criminal WRT the Dutch government.

Reply on news.ycombinator.com