Hacker News Reader

Comment by stefan_ | Hacker News Reader

Since there was substantial evidence that these were one and the same company. The CA had no substantial public certificate issuing program regardless so kicking it out was an easy decision either way (and begs the question what exactly it is they were doing to justify the multi million dollar operating costs of a root CA).

View on HN

>there was substantial evidence

circumstantial evidence, but nothing that was definitive

>The CA had no substantial public certificate issuing program

So just because they don't have enough customers they should be removed? This just promotes centralization of trust.

It really doesn’t matter if it was circumstantial or not. When presented with such evidence, the TrustCor rep was extremely evasive. This isn’t a court of law; if a Root CA can’t be up-front about explaining evidence that calls their trust into question, then they cannot be trusted and deserve to have their certificates yanked.

They were under attack. I actually read the whole thread and they were crystal clear.

Yeah I personally feel for the rep, they were indeed under attack. But there is no going around it, a company that advertised a product as being e2e encrypted when it really was not, having multiple levels of ties with the CA was enough to deem the CA as unfit.

I agree with this conclusion because the CA ecosystem is a fragile one if not governed strictly, since the risks are of the highest concern to the general use of the Internet.

> circumstantial evidence, but nothing that was definitive

CAs should be assumed guilty until proven otherwise.

> circumstantial evidence, but nothing that was definitive

That's not how things work. The role of a Certificate Authority is to act as a trusted third party. If that third party is unable or unwilling to demonstrate that they are trustworthy then naturally they can't be expected to assume that role.

Reply on news.ycombinator.com