Mozilla considers removing Trustwave CA

ronjor · Feb 8, 2012

Scandalised by the snooping certificate issued by Trustwave, a heise Security reader, Sebastian Wiesinger, has submitted a report to Mozilla's bug database in which he requests that Trustwave's root certificates be removed from all Mozilla products. Mozilla's Kathleen Wilson, who handles the issue, has accepted the submission and requested a statement from Trustwave. Trustwave's Brian Trzupek has already announced the release of further information which, he says, is still waiting for internal approval.
Click to expand...

http://www.h-online.com/security/news/item/Mozilla-considers-removing-Trustwave-CA-1430998.html

CloneRanger · Feb 9, 2012

MITM attacks for Real

Trustwave issued a man-in-the-middle certificate

All of the major browsers contain the Trustwave root certificate Zoom

Certificate authority Trustwave issued a certificate to a company allowing it to issue valid certificates for any server. This enabled the company to listen in on encrypted traffic sent and received by its staff using services such as Google and Hotmail. Trustwave has since revoked the CA certificate and vowed to refrain from issuing such certificates in future

*

Security experts and privacy advocates have been warning for a while that any CA and any sub-CA authorised by it are able to issue certificates for any server. This is a cause of particular concern in the case of some government CAs, where there is every likelihood that they could assist with monitoring activities. This is the first case that we are aware of where a respectable certificate authority has enabled third parties to issue arbitrary SSL server certificates for monitoring purposes. Trustwave claims, however, that this is common practice among other root CAs.

http://www.h-online.com/security/ne...-a-man-in-the-middle-certificate-1429982.html
Click to expand...

Common practice, WFF

I wasn't aware that Certs could be issued that worked Globally on Any server, & www

So game over then, or ?

CloneRanger · Feb 9, 2012

@ ronjor

Hi, sorry i missed your post

Log in or Sign up

Mozilla considers removing Trustwave CA

ronjor Global Moderator

CloneRanger Registered Member

CloneRanger Registered Member

Log in or Sign up

Mozilla considers removing Trustwave CA

ronjor Global Moderator

CloneRanger Registered Member

CloneRanger Registered Member

Useful Searches