sippingabonedry

I suspect Apple published no update and is relying on the CA's CRL and/or OCSP to do its job. But it's rate-limited, the connections time out, and iOS is hard-coded to soft-fail.

Like you my trust store is months old.

That said, I found separate installs of Firefox and Microsoft Edge that accepted *all* the bad certificates without a care.

The only browser that consistently rejected all of them was — you guessed it — Internet Explorer. A browser so old it couldn't even run the test properly but it did what it needed to and blocked all the servers.

Comment · 9 days ago

22 - 2 is not 3; did you write the key generation scripts for the eMudhra CA?

Comment · 9 days ago

> so that they end up with 200 comments on #2 on the HN front page

I'm more curious why the top post in this thread is solely attacking the guy's character and not refuting any of his claims.

> An empty blog by a person that may or may not exist with no contact info.

I'd hate to upset all the 'this guy is Keyser Söze' internet detectives, but you've described 90% of posters here (including yourself).

Comment · 9 days ago

The individual CA's host the OCSP and CRLs, not Apple.

It's possible the Indian CA is overloaded.

My question is why the system trust store has not been updated to distrust the shady root CA?

Comment · 9 days ago

> Further EDIT: iPadOS now accepts one of them. This has to be a load issue on the "got a problem site", surely?

No, because it lets you successfully navigate to the forged CA test site.

You'll get a message to the effect of, "you shouldn't see this, this is bad"

Try clicking the link containing the CA's name for any that fail the test.

Comment · 9 days ago

26.7.1 still (randomly) trusts 2 out of the 12 compromised chains. All browsers impacted.

Edit: I'm not the only one with this issue:

https://www.reddit.com/r/iphone/comments/1xbvxgd/emudhra_cer...

My best guess is it's soft-failing on a failed OCSP lookup?

Comment · 9 days ago

Wonderful.

Anyone else bother to notice iOS still trusts 2 of the forged certs on the test site? I'd like to politely know what the fuck is going on because this is far from being "fixed".

Comment · 10 days ago

The Microsoft SMB remote-root holes had much wider impact... you had things like railway station monitors going offline.

At the end of the day, nobody gives a shit if another WordPress blog gets hacked.

Comment · 10 days ago

It's election season, and data centers are being thrown around ads continuously to scare the olds into voting.

It's one bridge away from selling them Old Glory robot insurance.

"Data centers are everywhere and they consume old people's medicine for fuel."