(no subject)

[theweaselking]

Google drops an anvil on Symantec.

Symantec employees have been playing stupid games with their CA, without proper logging or auditing, and Google is fed the fuck up with it.

Comments

[skington.livejournal.com]

"we were still able to find several more questionable certificates using only the Certificate Transparency logs and a few minutes of work ... we expect Symantec to undergo ... a third-party audit ... That Symantec employees could not use the tool in question to obtain certificates for which the employee controlled the private key"

Wow. Shots fired.

[resonant.livejournal.com]

Good.