Re: Following up on Trustico: reseller practices and accountability

2018-03-04 Thread Ryan Sleevi via dev-security-policy
On Sun, Mar 4, 2018 at 4:04 PM, Eric Mill via dev-security-policy < dev-security-policy@lists.mozilla.org> wrote: > So, what would useful next steps be to improve security and accountability > for resellers? > It depends - do you view resellers as the user's delegated agent - that is, much like

Re: Following up on Trustico: reseller practices and accountability

2018-03-04 Thread Anis via dev-security-policy
Le dimanche 4 mars 2018 22:06:23 UTC+1, Eric Mill a écrit : > Last week, Trustico (a reseller, formerly for Symantec and now for Comodo) > sent 23,000 private keys to DigiCert, to force their revocation. This > showed that Trustico had been storing customer keys generated through one > or more

Following up on Trustico: reseller practices and accountability

2018-03-04 Thread Eric Mill via dev-security-policy
Last week, Trustico (a reseller, formerly for Symantec and now for Comodo) sent 23,000 private keys to DigiCert, to force their revocation. This showed that Trustico had been storing customer keys generated through one or more CSR/key generation forms on their website. Though Trustico disagrees,

Re: TunRootCA2 root inclusion request

2018-03-04 Thread Anis via dev-security-policy
Le mercredi 19 juillet 2017 10:10:19 UTC+1, Aaron Wu a écrit : > This request from the Government of Tunisia is to include the “Tunisian Root > Certificate Authority - TunRootCA2” root certificate, and enable the Websites > trust bit. > > The request is documented in the following bug: >