Re: [TLS] Proposing CAA as PKIX Working Group Item

[Geoffrey Keating <[e-mail]>]

Yoav Nir <[e-mail]> writes:

> Yoav Nir <[e-mail]> writes:
> 
>> In late 2008, when some researchers got RapidSSL to sign a certificate
>> request that collided with their rogue sub-CA certificate, several things
>> came to light:
>> - They were a ridiculously small company, with the only full-time employee.
>> An accountant
...
> I'm not sure where I've read it. Probably some blog entry about the incident. Not Bruce Schneier's because his entries are still online. 
> 
> Anyway, checking the data for now, Business Week has this:
> http://investing.businessweek.com/research/stocks/private/people.asp?privcapId=20888814
> 
> It lists two "key executives", VP Marketing and VP Sales and no CEO/President. Click their links, and both have other jobs at Globalsign and other companies.
> 
> The key issue is the total lack of in-house expertise. Late in 2008, it wasn't RapidSSL that switched to MD5. Verisign did it for them:
> http://www.thetechherald.com/article.php/200852/2708/VeriSign-replaces-RapidSSL-certificates

RapidSSL is owned by GeoTrust which at the time was owned by VeriSign
(thus the press release), and now by Symantec.  It wouldn't surprise
me if RapidSSL itself has no employees at all.  I don't think Business
Week's data is reliable in this case.