Definitely true but this scenario worries me: 1. Get a signed cert from a recogn... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

rjbond3rd on Aug 8, 2011 | parent | context | favorite | on: The Definitive Guide To Website Authentication

Definitely true but this scenario worries me:

1. Get a signed cert from a recognized CA (fraudulently - not impossible).

2. Hijack the DNS (e.g., get their GoDaddy password, or point them to a DNS server you control)>.

3. The user is directed to the fake server with the fraudulently obtained cert, and does not receive a warning.

JVerstry on Aug 8, 2011 [–]

Absolutely, authentication is not bullet-proof. That's why certificate authorities have to invalidate certificates from time-to-time.

rjbond3rd on Aug 8, 2011 | [–]

True, and of course they can only revoke the ones they know are fake. And the browser/client has to respect the revocation list.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact