you are viewing a single comment's thread.

view the rest of the comments →

[–]Jesus 4 insightful - 1 fun4 insightful - 0 fun5 insightful - 1 fun -  (3 children)

They've been plagued with fraudulent cert issuing problems since at least 2011, here's a article about it;

Comodo was bought recently by Francisco Partners who also counts among its investments companies like SonicWall, which produces SSL proxy boxes, and NSO Group, which produces government spyware, among other cyber-surveillance upstarts. Last time we heard, Francisco Partners was trying to flog Pegasus-developer NSO for about a billion bucks.

(At one point, Francisco Partners owned Blue Coat, another SSL proxy box shifter, but sold that to Symantec.)

The concern is that HTTPS certificate-issuing authorities, such as Comodo, are trusted by browsers: that's essential because website owners buy SSL/TLS certs from outfits like Comodo, and the browsers need to trust Comodo in order to verify whether or not a certificate used by a HTTPS website is legit.

If there is some kind of future collusion between Comodo and one of Francisco's spyware makers, such as the creation of trusted root certificates for SSL/TLS interception gear, then people with these surveillance devices on their network could have their encrypted web traffic silently snooped on. This kind of equipment is usually sold to enterprises to monitor staff or websites, but it could potentially be used by governments and other organizations to spy on netizens.

As Liverpool, England-based security consultant Kevin Beaumont Tweeted:

>>As a security community we have built solutions that rely on every CA being trustworthy. That needs to change. The model is broken.
>>— Kevin Beaumont 🐿 (@GossiTheDog) October 31, 2017

Comodo has issued 91 million certificates to more than 200,000 customers worldwide and claims top spot in the CA market. However, its record operating its CA alongside other businesses wasn't spotless: in 2016, it was accused by Google of crafting a Chrome knockoff that undermined user security, repeating behaviour the US Department of Homeland Security criticised in 2015.

A certification issuance blunder in November 2015 resulted in the company withdrawing incorrectly-issued certificates, and it lost a trademark stoush with popular free CA LetsEncrypt last year.

Francisco Partners has appointed former Entrust COO Bill Holtz as CEO of Comodo CA, and SonicWall CEO and president Bill Conner as chairman. Comodo founder Melih Abdulhayoglu remains as minority owner and board observer.

[–]magnora7[S] 2 insightful - 1 fun2 insightful - 0 fun3 insightful - 1 fun -  (2 children)

Hmm that's very interesting. Thanks for bringing this to my attention. I'll have a talk with our sever guy in a few days and see what he thinks of the situation.

[–]d3rr 2 insightful - 1 fun2 insightful - 0 fun3 insightful - 1 fun -  (1 child)

It looks like CloudFlare's SSL certificate issued by Comodo... it is issued to "". Our SSL certificate on the server that is also being used should say "LetsEncrypt" or something but I'm not sure how to check that with CloudFlare on.

But Jesus makes some good points. Maybe there's a CloudFlare alternative we could find.

[–]magnora7[S] 2 insightful - 1 fun2 insightful - 0 fun3 insightful - 1 fun -  (0 children)

Yeah it's definitely something to consider. I'll talk this over with our server guy and see what he says, because he's great with netsec stuff.