redsolver on Mythryl: “It's frustrating that major web browsers still don't support…”

It's frustrating that major web browsers still don't support DANE/TLSA, after over a decade! With DNSSEC and TLSA 1 1 1, domains could require both a valid CA-issued certificate AND a matching pubkey hash. It would stop rogue-CA certs in browsers that support it, without reducing security for others

Filippo Valsorda@filippo.abyssdomain.expert

🚨 Six WebPKI Intermediate CAs are compromised. This is bigger than Heartbleed, but a client-side issue. Anything that verifies certificates against public roots, like most TLS clients, is/was affected. Details, live test, patched versions and workarounds at emudhra.we-have-a-problem.com Act now.

emudhra.we-have-a-problem.comeMudhra Intermediate CA CompromiseeMudhra Intermediate CA Compromise

20/10/26, 7:09 pm3 reposts17 likes

Post